dialup ipsec VPN + many interfaces/subnets

Forum|Forum|16 years ago
October 15, 2009
9 replies
9951 views

Hi ! I' m trying to setup access from notebook (FortiClient) to all my subnets on diferent interfaces (picture below). I set " interface mode" ipsec VPN with proper firewall polices (I think) but I can reach ONLY FIRST subnet definied in Forticlient.

If I change sequence of subnets in client I can reach next one (alway only first one) so I think Fortigate config is OK. When I sniff traffic I can see that all packet (tested with icmp/ping) to all subnets are ok - I mean - echo request reach targets in every subnet AND echo replay is COME BACK through dialupVPN_interface !!! Do I need to setup 3 x Quick Mode Selectors (with proper subnets) in phase2 in this case ? Maybe I need to use agressive mode ? (but I think it doesn' t metter) Does anyone made config like this ? ... any working example ? ... Thanks in advance Dominik

Zx71917.gif

dominikwAuthor

New Member

I can use a " trick" , but that is not the point. When I set remote network in forticlient as 0.0.0.0/0 - all trafic is routed to Fortigate and I have access to all subnets. Then I had to create policy on FG to " let me out" to Internet. Everything works OK but Internet browsing is slow - all trafic goes to FG and then to Internet. I want to route via vpn ONLY traffic to my remote subnets and all the rest via my own connection. Is it possible on FG / FortiClient vpn ?

laf

New Member

Nice scenario. Curiosity: for Internet access did you set up a FW rule from VPN_interface to wan1 with NAT? About your scenario: 0.0.0.0/0 should do it. You can t do it otherwise, I mean you have to sum up all your three networks and the result is 0.0.0.0/0. I see only one solution: change your networks IP_addressing_scheme for your DMZ in 192.168.3.0/24 and sum up all these three networks in 192.168.0.0/23 on your Forticlient config.

dominikwAuthor

New Member

Yep ! I did set up a FW rule from VPN to wan with NAT (IPsec in interface mode). I did almost the same for ssl-vpn only policy looks : ssl.root --> wan (with NAT) BTW Idea with 192.168.0.0/23 seems to be interesting, but in 10... I have many services and it' s impossible for now. I wonder what about : http://kc.forticare.com/default.asp?id=580&Lang=1&SID= ???

A

Anonymous_User

Contributor III

it is possible, by adding two subnets in forticlient config, and adding a policy for the second subnet. How to set up FortiClient IPSec VPN to reach multiple non-sequential remote subnets on a FortiGate; http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD30815&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=452235&stateId=0 0 454243 i am now trying to do this with automatic policy server ipsec vpn, but still no luck yet....

dominikwAuthor

New Member

Thanks man, thanks a lot !!!! Quick selector with names works perfect !!! Actually I use 4 subnets and I can get into everyone.

A

Anonymous_User

Contributor III

No problem, but i am intrested in your IPSEC way of connecting; are u using forticlients config or an automatic policy server? (with the forticlients presharedkey method it works, but i use ldap athentication with policy server so u dont have to mess around with keys, just the normal login people use at the office...)