Skip to main content
Raffael_Hotz
Raffael_Hotz
New Member
July 6, 2021
Question

IPsec/SSL VPN no connection to OSPF sites

  • July 6, 2021
  • 3 replies
  • 2339 views

Hi guys,

I have my main FGT which has area 0.0.0.0 and some other areas which are connected to other sites via OSPF.

When I am directly connected to a subnet which lies in area 0.0.0.0 I can access everything, also I see that every route is propagated nicely. Now as I use OSPF I do not have any routes to the sites nor do I have policies with IP-ranges - just the regarding OSPF-interface tunnel with destination all.

Now my problem is when I connect via IPsec or SSL I cant see anything. I read already that you should do a static route to blackhole/ssl.int with the right ip-range and then redistribute static... I then saw the subnet on my branch-sites, but couldnt access them nonetheless. The policy was sourceintf SSL/IPsec - destintf Site1/2/3/xxx. sourceip the right IPsec or SSL range and destination all... I had the right network in the OSPF-network list, I had them as passive,...

What is it I am missing?

 

Thanks

Raffa

    3 replies

    preetisingh
    Staff
    preetisingh
    Staff
    October 27, 2024

    Can you share ospf configuration. 

    refer :

    https://community.fortinet.com/t5/FortiGate/Technical-Tip-Announcing-SSL-VPN-address-range-into-OSPF/ta-p/239418 

    mokocub1
    mokocub1
    New Member
    October 27, 2024

    You would need to create a static route pointing to SSL VPN interface and then redistribute static in OSPF.

    If you want to control what static routes are redistributed to OSPF, you can create a prefix list and a route map in CLI https://routerlogin.uno/ .

    DPadula
    Staff & Editor
    DPadula
    Staff & Editor
    October 27, 2024

    Another option would be avoid using split-tunnel and have all traffic sent to the FGT via SSL VPN. Doing that you will guarantee that does not matter what is the destination subnet all traffic will be sent to FGT.  

    This option will request less configuration and maintenance in comparison to the prefix list + route map as suggest previously. The down side of it is all traffic will be sent via SSL VPN tunnel, including traffic that should be going to Internet.

    Terms & ConditionsAccessibility statement