How to access remote ressource via IPsec Site-to-Site for SSL VPN user

Forum|Forum|3 years ago
October 20, 2022
3 replies
1871 views

Hello,

We have set up a Site-to-Site VPN tunnel between 2 FortiGate, the IPsec VPN tunnel works very well.

We also have an SSL VPN on the FortiGate A and FortiGate B.

This is restrictive for users who telecommute, they must use one of the 2 SSL connections to access the resources of FortiGate A or FortiGate B.

Ideally, from the FortiGate A SSL VPN connection, we will want to include access to FortiGate B resources.

I have followed the procedure, but It's not working (pings don't respond, same for traceroutes even if it gets logs) :

https://community.fortinet.com/t5/FortiGate/Technical-Note-How-to-access-remote-resource-via-IPsec-for-SSL/ta-p/192179

Thank you in advance for your help.

I can post the network topology if needed, even if it will strongly resemble the one in the procedure.

FortiGate

anikolov

Staff

Hello David,

The simplest way to implement this would be to use a SNAT address from the IPSec tunnel local phase2 selectors, as this already works for you. If you would like a different solution, let me know so we can discuss it.

Regards,

DavidCAuthor

New Member

Hello Anikolov,

Thanks for your feedback, I tried with the SNAT address method but it didn't work.

What other solutions could I try?

akristof

Staff

Hello,

Without SNAT, you need to make sure that 2 SSLVPNs are using different subnet for clients. Then you can add the SSLVPN subnet into ipsec as a source selector with correct destination selectors. If you are using wildcard selectors, you just need to make sure that on FortiGate B you have correct route for SSLVPN subnet from FortiGate A via tunnel (to avoid RPF). And then firewall policy on FortiGate A from ssl.root towards ipsec tunnel is needed. If you did this (or with SNAT) and it is not working, run debug flows on both devices and check where the traffic stops.

Sign up

Login with SSO

Login to the community

Login with SSO