FortiClient IPSec VPN to VLAN

Hi All,

I'm tired of beating my head against this wall and am hoping one of you may have a sledgehammer or wrecking ball I can borrow. The use case is as such: PLC vendor needs access to specific VLAN on our network so they can remotely manage their systems. They requested an IPSec VPN to access via the FortiClient.

So far I have an IPSec VPN set up that works almost flawlessly. User can connect, is unable to ping any of our internal IP addresses and can even ping the IP address (172.22.5.2/24) on our core cisco stack. That IP is the VLAN172 IP address. If I SSH in to the cisco device I can ping everything on that subnet no problem. Pinging and tracerouting via the Fortigate CLI succeeds to all 172 subnet addresses as expected as well. But from the VPN the cisco is the only IP address I can ping successfully.

On the internal interface I have a VLAN set up with the proper VLAN ID and 172.22.5.6/24 as the IP address. I have the 172.22.5.0/24 Subnet set up as a firewall object as well as the VPN subnet. I have a single policy set up allowing traffic from the VPN Subnet to the 172 Subnet (always/ALL) and a static route set up from the VPN Subnet to the VPN.

Doing a tracert while connected to the VPN shows it hitting my primary internal interface rather than the VLAN interface. At this point I believe that the VPN is routing across the internal interface rather than the VLAN sub-interface.

Phase1

config vpn ipsec phase1-interface     edit "172 VPN"         set type dynamic         set interface "wan2"         set mode aggressive         set xauthtype auto         set mode-cfg enable         set proposal 3des-sha1 aes128-sha1         set authusrgrp "172 IPSec VPN User Group"         set ipv4-start-ip 10.10.20.101         set ipv4-end-ip 10.10.20.110         set ipv4-netmask 255.255.255.0         set dns-mode auto         set ipv4-split-include "172 Subnet"         set psksecret     next end

Phase2

config vpn ipsec phase2-interface     edit "172 VPN"         set phase1name "172 VPN"         set proposal 3des-sha1 aes128-sha1     next end

There is one policy in place that is set up with Incoming Interface (172 VPN), Source Address (VPN Subnet), Outgoing Interface (172 VLAN), Destination Address (172 Subnet). All/Always/ NAT is disabled. I also have a static route in place to go from the VPN IP Subnet to the VPN.

Hopefully this makes sense and someone here has the magic bullet to make this VPN work as expected.

Thanks!