Skip to main content
DrZoidberg
DrZoidberg
New Member
July 10, 2017
Solved

ipsec vpn using fortigate 60d / fortinet 5.2 and forticlient

  • July 10, 2017
  • 2 replies
  • 6507 views

good morning,

 

we have used the conf decribed in the title for a while to allow external users to connect to an internal samba share. the setup followed the cookbook example. this worked very well until we changed the internet provider.

the new provider uses ppoe, to support this we had to add a static route:

 

Destination 0.0.0.0/0 Device wan1 Gateway 123.123.123.9 

 

the ip of wan1 is 123.123.123.10. this works for everything (wlan, internal network, rdp from external clients, internal web servers ...) except for the vpn connections. after adding a second policy to allow traffic from wan1 to the vpn interface i'm able to connect with forticlient and there's some data transfered in both directions. the client gets an ip address  but i'm not longer able to see the internal network resources.

 

any ideas how to fix this?

 

thanks

lorenz

    Best answer by Toshi_Esumi

    Are you sure about the static default route you put in? PPPoE normally injects the default static route with GW automatically into FG's routing table with "ppp1" as the interface (not wan1). Although you still use wan1 in your policies, if you still have to put some static routes toward the circuit you need to have dynamic-gateway enabled (I think you can do it only with CLI) without GW IP then it would automatically point to ppp1 with the GW IP whatever it pulled.

    Check the routing table via either GUI or CLI.

    2 replies

    EMES
    EMES
    New Member
    July 10, 2017
    Do you have a route for your ssl von subnet pointing at ssl.root and a policy allowing the ssl.root interface to the inside?
    Toshi_Esumi
    SuperUser
    Toshi_EsumiAnswer
    SuperUser
    July 10, 2017

    Are you sure about the static default route you put in? PPPoE normally injects the default static route with GW automatically into FG's routing table with "ppp1" as the interface (not wan1). Although you still use wan1 in your policies, if you still have to put some static routes toward the circuit you need to have dynamic-gateway enabled (I think you can do it only with CLI) without GW IP then it would automatically point to ppp1 with the GW IP whatever it pulled.

    Check the routing table via either GUI or CLI.

    DrZoidberg
    DrZoidbergAuthor
    New Member
    July 17, 2017

    hi toshi,

     

    sorry for the late answer. 

    yes, we need that static route. ppoe is not done by the fortigate, we have to use a modem. the setup looks like this:

     

    ONT -> 123.123.123.9 : modem (audiocodecs mediant) : 123.123.123.10 -> wan 1 fortigate 

     

    i've set up a ipv4 policy from wan 1 to the vpn address range (and vice versa). as mentioned i'm able to connect to the vpn and the client gets an vpn range ip adress. but there's no route to the internal network.

    Terms & ConditionsAccessibility statement