Skip to main content
bashrael
bashrael
New Member
December 9, 2016
Question

ipsec vpn / access local printer

  • December 9, 2016
  • 2 replies
  • 46131 views

Hi,

I want people to be able to connect to our office over vpn.  

When they do this I prefer all their internet traffic also goes through our fortigate.

This works when I setup a ipsec vpn without split tunnel.

 

But some users need to be able to print on their local network printer.

If I set up a split vpn tunnel this works but then the internet traffic goes over their local gateway.

 

So how can I solve this?

I'm on fortios 5.2.10

thanks!

    2 replies

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    December 9, 2016

    no split-tunnel vpn shouldn't break local LAN device access. Just default route going into the tunnel.  If remote user's PC is 192.168.1.10/24 and he/she should be able to reach a printer with 192.168.1.100 regardless the tunnel is up or not. Did you check the routing table on the PC when the tunnel is up?

    bashrael
    bashraelAuthor
    New Member
    December 10, 2016

    hi tx for the answer.

    my local network 192.168.4.0/24

    vpn 10.10.254.100-10.10.254.150

    this is the routing table:

    IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.4.100 192.168.4.54 36 0.0.0.0 0.0.0.0 10.10.254.101 10.10.254.100 1 10.10.254.100 255.255.255.255 On-link 10.10.254.100 257 remote ip 255.255.255.255 192.168.4.100 192.168.4.54 35 127.0.0.0 255.0.0.0 On-link 127.0.0.1 331 127.0.0.1 255.255.255.255 On-link 127.0.0.1 331 127.255.255.255 255.255.255.255 On-link 127.0.0.1 331 169.254.1.1 255.255.255.255 10.10.254.101 10.10.254.100 1 192.168.4.0 255.255.255.0 On-link 192.168.4.54 291 192.168.4.54 255.255.255.255 On-link 192.168.4.54 291 192.168.4.255 255.255.255.255 On-link 192.168.4.54 291 224.0.0.0 240.0.0.0 On-link 127.0.0.1 331 224.0.0.0 240.0.0.0 On-link 10.10.254.100 257 224.0.0.0 240.0.0.0 On-link 192.168.4.54 291 255.255.255.255 255.255.255.255 On-link 127.0.0.1 331 255.255.255.255 255.255.255.255 On-link 10.10.254.100 257 255.255.255.255 255.255.255.255 On-link 192.168.4.54 291

     

    So if I look at this I think its normal i cannot reach my local network.

    0.0.0.0 0.0.0.0 10.10.254.101 10.10.254.100 1

    this catches everything and send it to my remote network.

    If I use a split tunnel the metric of this route is much higher

     

    So I guess I need to change the metric of that route and put a route before it that points to my local network.

    I could program it on my local computer but thats no solution since I dont know what lan other users will have.

    So how do I do this on the fortigate?

    tx

     

     

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    December 11, 2016

    No. The routing table is normal but you still should be able to reach IPs in the connected subnet. Otherwise you can't reach even the GW device 192.168.4.100 for the tunnel to work. The default routes are used only when more specific routes don't exist in the table. Something else seems to be wrong if you can't ping the local devices. I would suggest run Wireshark to see if the ping packets leave the PC or not. 

    bashrael
    bashraelAuthor
    New Member
    December 14, 2016

    With some help of fortinet support this problem is solved.

    Config ip tunnel without split on your fortigate

    Connect your forticlient and test if connection works.

    backup your config in forticlient and edit the backup file

    add following:

    In the <ipsecvpn> section after </options> add these xml tags so it would with the xml file structure:  <connections>  <connection>  <ike_settings>  <enable_local_lan>1</enable_local_lan>  </ike_settings>  </connection>  </connections>  </ipsecvpn> 

     

    save and restore this file in your forticlient.

    Test again.  you can now access your local Lan.

    grts

    pitamerica
    pitamerica
    New Member
    May 18, 2017

    Hi, thank you. But i backup the file and searched for the strings you wrote. i can´t find it. The only thing i can find is the vpn config section like this :

     

    edit "vpn1"

            set type dynamic

            set interface "wan1"

            set xauthtype auto

            set mode aggressive

            set mode-cfg enable

            set proposal 3des-sha1 aes128-sha1

            set authusrgrp "Wizard_users"

            set ipv4-start-ip 192.168.50.10

            set ipv4-end-ip 192.168.50.40

            set ipv4-netmask 255.255.255.0

            set dns-mode auto

            set ipv4-split-include „**********“

            set psksecret ENC ****************

    Terms & ConditionsAccessibility statement