IPsec VPN can access my Movie server but not Hikvision cameras via Hik-Connect?

Question

Very simple vpn set up for my iPhone. I have a Fortigate 40F firewall. I'm able to access my movie server after successfully connecting to the vpn but not the hikvision cameras that I have configured on the Hik-Connect app. I can reach https://x.x.x.x:443 (camera1) on my iPhone using Safari while connected to the vpn. so that port is working.

The live feed fails once it hits 80%. "device connection timed out" Please check its network connection. But I can reach my movie server and access the web sign in of the camera using https. Help? Cameras work flawlessly when on the local network through wifi.

VPN is allowed to access my entire lan and "all" services (ports)

Modem > Fortinet > Ubiquiti 24 Port PoE > connects all my ethernet, three aps and 5 cameras. All on 10.10.10.0/24. Flat network nothing else. NVR is a Windows 11 Pro Host running iVMS-4200. No VLANs, nothing. Flatter than Earth.

Log Allowed Traffic is set to "All Sessions"

atakannatak · Answer

Hi @buk,

Based on your explanations, I can suggest two different methods as follows:

NAT Considerations: Since NAT is enabled in the policy, but the internal network (10.10.10.0/24) is already managed behind the firewall with the firewall as the default gateway, NAT may not be necessary. Using NAT in this scenario could lead to application errors due to TCP connection limits when multiple sessions share a single IP. Disabling NAT could help eliminate these issues and improve connectivity stability.
Handling Connection Timeouts: Network slowness between the application server and VPN users may cause application-level connection timeouts. To mitigate this, TCP session timeout values should be adjusted on both the application and firewall. FortiGate allows modifying session timeout values on a per-policy basis, helping to maintain connection stability. More details on session timeout configurations can be found in:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Session-timeout-settings/ta-p/191228

If these solutions do not resolve the issue, we can perform a detailed analysis by capturing debug logs and packet traces. Please run the following commands while accessing the application and share the debug outputs along with the packet capture (PCAP) file obtained from the firewall:

diagnose debug disable
diagnose debug flow trace stop
diagnose debug flow filter clear
diagnose debug reset
diag debug console timestamp enable
diagnose debug flow trace start 1000
diagnose debug flow filter saddr X.X.X.X -- (Your SSL VPN client IP address)
diagnose debug flow filter daddr Y.Y.Y.Y -- (The server IP address)
diagnose debug enable

Additionally, you can refer to the following article for instructions on capturing Wireshark output from the FortiGate firewall. Sharing these details will help us conduct a thorough investigation and pinpoint the root cause of the issue.

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Packet-Capture-on-FortiOS-GUI/ta-p/194444

BR.

If my answer provided a solution for you, please mark the reply as solved it so that others can get it easily while searching for similar scenarios.

Atakan ATAK
CCIE #68781

Sign up

Login with SSO

Login to the community

Login with SSO