FortiGate VPN

Forum|Forum|2 years ago
December 4, 2023
1 reply
1520 views

Good day,

I have posted about this issue before but have got a bit further so wanted to start where I am.

I am running FortiGate 7.2 with a VPN NOT in Split Tunnel mode authenticating to DUO VPN and LDAP.

The current VPN was setup my someone else who has left the company and trying to create more "VPN - Tunnel All" so that I can give different Web Filters based on users AD group.

I have created the Firewall Rule below with an AD group "VPN-OUT-ITSU" currently disabled below which allows the VPN to connect and filters the Web Traffic correctly but does not allow the user to access local resources which is should.

I have noticed that when I try and connect on the new Firewall Policy via FortiClient VPN the percentage goes to 98% before I have to do the two-factor code, and the old one goes to 45% which is odd.

I cant see what is going wrong and why when I enable the new one and I test I cant get to any resources.

Thanks for any advice and help.

Julian

FortiGate 041223.png

jiahoong112

Staff

Referring here: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SSL-VPN-and-two-factor-expiry-timers/ta-p/191661

As your are using DUO as MFA for your remote users, the authentication might have timed out before the sslvpn connection got to complete. I would recommend to increase the remoteauthtimeout value from the default 5 seconds to something like 60 seconds.

julianhainesAuthor

Explorer II

thanks for the reply, the VPN does connect and I can see it connected in the FortiGate console, it looks like its just not routing traffic to the local LAN.

hbac

Staff

Hi @julianhaines,

In that case, you can run debug flow to see if traffic is being dropped. Please refer to https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-First-steps-to-troubleshoot-connectivity/ta-p/192560

Regards,

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded