IPSec can not share internet.Help.

Hi itadori98,

The issue likely stems from misconfigured firewall policies or routing issues.Ensure that policies allow traffic from the VPN tunnel to the internet and vice versa.

Verify that routing is correctly configured, particularly if split tunnelling is enabled.

Is traffic to your internal servers not working either or is it just internet access?
If its both maybe the ip pool is clashing with the users local network at home.

If everyone else is fine, then the FortiGate shouldn't be a problem (or the first thing to be checked).

Have you tried having the same user connect from a different machine? Or different user from the same machine?

Kindly have a look at this article to see if you are missing any configuration?
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Dialup-VPN-Configuration-Between-Two-FortiGates/ta-p/197667

Regards,
Aman

As @sjoshi mentioned, the very first thing you need to take care of when you want to let remote locations to use the center/HQ location's internet is the default route for the remote locations.
It has to go toward the tunnel, not to the local internet.

But if you simply set a default static route to the tunnel interface, it would just break the tunnel not to come up because no route to the peer public IP through the local internet.
So if the HQ has a static public IP, just add a /32 static route toward the wan interface on the remote side. Then you can use the static default route to the tunnel.
Or, if the HQ's public IP is a dynamic, you need to set up a DDNS at the HQ so that remote can use the FQDN for the same static route instead of the /32.

The rest is about phase2 selectors and policies to allow the traffic on both ends of the tunnel.

Toshi

Hi @itadori98 ,

You need to make sure:

1) On HQ FGT, you do have firewall policies allowing traffic from two dialup VPN tunnels to the Internet.

2) You do have NAT enabled in those firewall policies.

If it is still not working, please run debug flow commands on the HQ FGT and test it with Ping 8.8.8.8 from the client.

https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/38044/using-the-debug-flow-tool

So possible debug flow commands look like as below:

diag debug flow show iprope enable

diag debug flow filter addr 8.8.8.8

diag debug flow filter proto 1

diag debug flow trace start 10

diag debug enable

Then run the Ping for testing.  Please DO NOT run continuous Ping.