How to advertise a site-to-site VPN subnet to SSL VPN connections

Hi @MadDog_2023
I understood that you want to advertise ipsec vpn subnet 192.168.166.0/24 to SSLVPN user, you can do the same under the SSLVPN portal which you are using for the SSLVPN users. If you are using split tunneling under the tunnel mode you can add ipsec vpn subnet 192.168.166.0/24 into the routing address field. 

You have to configure the SSL VPN policies accordingly (add subnet 192.168.166.0/24 in sslvpn policy) . Also the SSLVPN subnet should be part of phase2 selector in ipsec vpn configuration and policies should allow the traffic.

Below is the article for Split tunnel with SSL VPN:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Enabling-split-tunnel-feature-for-SSL-VPN/ta-p/198108

SSL VPN to IPsec VPN
https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/45836/ssl-vpn-to-ipsec-vpn#:~:text=Go%20to%20VPN%20%3E%20SSL%2DVPN%20Portals.,created%20by%20the%20IPsec%20Wizard.
 

Regard's,

Pratik

Hi @pjawalekar,

Thanks for your reply.

I will have a look on the articles you provided.

Interestingly, when under Policy & Objects - Addresses I changed 192.168.166.0/24 to a more specific 192.168.166.10/32 address it started to be advertised. 

Is it normal behavior for FortiGate?

Hey,

Have you configured the routing tables appropriately?

Proper routing configuration is crucial for directing traffic to the desired subnets. Have you added the necessary routes to ensure that traffic bound for the site-to-site VPN subnet is correctly routed through the SSL VPN connection?

What routes are in your client device routing-table? For Windows "route -print" for Mac "netstat -nr".

Do you see 192.168.166.10/32 there? As @pjawalekar and @Anonymous explained, a common way to specify the subnets to be inserted (not advertised) in split-tunnel is to specify them in SSL VPN portals.

But you sounded like you didn't do that way but specified only at the ssl.root->BO-TUNNEL policy, which is referring to the "address" object you changed.

But I feel something is off. That's why I'd like to see what exactly in the client's table.

Toshi

Hi @MadDog_2023,

When you add the whole subnet not the /32, what is the local routing table on client machine? Did you see the subnet via SSL VPN?

Regards,
Minh

In the SSL VPN configuration, look for an option to specify the "Local Ingress Interface" or "Routing" settings. Ensure that the 192.168.166.0/24 subnet is included in the allowed networks for SSL VPN users.