How to route L2TP clients to another VPN

Forum|Forum|4 years ago
February 12, 2022
5 replies
3623 views

Hello,

I have the following setup:

FG 60F at our HQ - LAN IP: 192.168.205.0/24

FG 60F at our DC - LAN IP: 192.168.5.0/24

L2TP clients connecting with Dial-up connection and getting IP from subnet 192.168.199.0/24

HQ and DC are connected via site-to-site ipsec VPN and both subnets x.x.205.0/24 and x.x.5.0/24 can communicate.

When I connect to HQ as a L2TP dialup user I can access the network on HQ x.x.205.0/24 but I cannot connect to DC. I add a policy on HQ which allows traffic from L2TP-VPN to DC but it is not working.

Can anyone please help set this up so a dialup user will only have to connect to HQ to gain access also to DC?

Best answer by akristof

Hello,

Thank you for your question. Based on the information, I would verify couple of things:

- If you are using specific selectors on ipsec, you might need to create new selector for 192.168.199.0/24 subnet

- If you are using any/any, verify, that the DC firewall knows how to route traffic 192.168.199.0/24 back to HQ firewall

- Verify that the subnet 192.168.199.0/24 is allowed in all firewall policies on both firewalls

If after this it is still not working, run debug flow on both devices at the same time and see where the problem is. If it is on HQ or DC firewall and based on that you can follow up.

akristofAnswer

Staff

Hello,

Thank you for your question. Based on the information, I would verify couple of things:

- If you are using specific selectors on ipsec, you might need to create new selector for 192.168.199.0/24 subnet

- If you are using any/any, verify, that the DC firewall knows how to route traffic 192.168.199.0/24 back to HQ firewall

- Verify that the subnet 192.168.199.0/24 is allowed in all firewall policies on both firewalls

If after this it is still not working, run debug flow on both devices at the same time and see where the problem is. If it is on HQ or DC firewall and based on that you can follow up.