Skip to main content
kkbk96
kkbk96
New Member
August 10, 2022
Question

forticlient vpn issue from windows 11 laptop, OS version 7.2.0

  • August 10, 2022
  • 7 replies
  • 13780 views

So the vpn connects fine but there seems to be some issue with routing or something since i cannot get to any network behind my Fortigate 60E (which is the firewall I'm using for this).

 

ipconfig on windows:

 

Ethernet adapter Ethernet 4:

Connection-specific DNS Suffix . :
Link-local IPv6 Address . . . . . : fe80::5184:1128:9cd8:c861%12
IPv4 Address. . . . . . . . . . . : 192.168.2.15
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.2.16

 

why does it get 192.168.2.16 as the default gateway? i included that as part of the ip vpn pool which is 192.168.2.10-192.168.2.15

 

Also how does the routing work when you are connected to this vpn?

 

Firewall config:

kkbk96_0-1660170208710.png

3 rules created and 0 hits on all.

 

ConnectedtoSwitch (internal1) - 192.168.2.10/24

RemoteAccess_range - 192.168.2.15 - 192.168.2.30

Remote Access_split1 - 

Vlan 20 addressVlan10 address

Vlan 20 - 192.168.20.0/24

Vlan 10 - 192.168.10.0/24

 

Routing table:

Routing table for VRF=0
S* 0.0.0.0/0 [5/0] via 17x.x.x.x, wan1, [1/0]
C 169.254.1.1/32 is directly connected, RemoteAccess
C 17x.x.x.0/24 is directly connected, wan1
C 192.168.1.0/24 is directly connected, internal2
C 192.168.2.0/24 is directly connected, internal1
C 192.168.10.0/24 is directly connected, Vlan10
C 192.168.20.0/24 is directly connected, Vlan 20

 

VPN Config:

kkbk96_1-1660170541034.png

 

What should i do to get it to work?

 

Let me know if i need to post more configs.

Thank You.

    7 replies

    Anthony_E
    Staff
    Anthony_E
    Staff
    August 13, 2022

    Hello kkbk96,

     

    Thank you for using the Community Forum.

    I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

     

    Regards,

    Best Regards
    kkbk96
    kkbk96Author
    New Member
    August 13, 2022

    hopefully someone replies, havent seen anyone reply yet

    Anthony_E
    Staff
    Anthony_E
    Staff
    August 14, 2022

    Hello,

     

    We will look for an answer and will not stop.

     

    Regards,

    Best Regards
    Anthony_E
    Staff
    Anthony_E
    Staff
    August 16, 2022

    Hello,

     

    Waiting the answer, I leave you the FortiOS 7.2.0 release note:

     

    https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/5967294d-aa31-11ec-9fd1-fa163e15d75b/fortios-v7.2.0-release-notes.pdf

     

    I continue to find somebody for helping you.

     

    Regards,

    Best Regards
    sw2090
    SuperUser
    sw2090
    SuperUser
    August 16, 2022

    I guess 192.168.2.16 is the remote end of your vpn (i.e. yoour FGT). If it gets that as default gw that would mean either split tunneling is not enabled or split tunneling does not work for some reason.

    In this case the routing table of your client would be interesting. 

    I would guess it then has two default routes and the one that is not over the vpn has the lower metric. 

    That together with what I wrote about split tunneling would explain your issues after all :)

     

    If split tunneling is enabled for the subnets you want to reach (and is also working) your client would not get a new default gw but instead it would get routes to those subnets specified in split tunneling that have the FGT as gateway.

     

    kkbk96
    kkbk96Author
    New Member
    August 16, 2022

    yes split tunneling is not enabled, i would like to get this to work without enabling split tunneling. i will share the routing client routing table later today. Should be "route print" for windows right?

    sw2090
    SuperUser
    sw2090
    SuperUser
    August 16, 2022

    without split tunneling it should work if that default route (over the tunnel) is the only one or has the lowest metric.

    The big contra of this is that it would also send all your internet traffic through the tunnel. So in order to still have internet you would need to have policy to allow vpn to internet with nat on your FGT.

    I would not recommend this. I would recommend using split tunneling instead...

    kkbk96
    kkbk96Author
    New Member
    August 16, 2022

    ok ill try enabling split tunneling then. all i want is to have internet connection as well with the vpn turned on.

    sw2090
    SuperUser
    sw2090
    SuperUser
    August 16, 2022

    and yes its "route print" on windows. Or "netstat -rn" on MacOSX. Or just "route" on Linux :)

    kkbk96
    kkbk96Author
    New Member
    August 16, 2022

    ok thanks will probably post the route details in about 8-9 hours from now.

    Terms & ConditionsAccessibility statement