Skip to main content
kaika313
kaika313
New Member
February 15, 2023
Solved

Issues connecting to remote SSL VPN connected client

  • February 15, 2023
  • 5 replies
  • 4809 views

Hi,

 

we're using a FortiGate 100E (v6.0.2 build0163 (GA)) with SSL VPN configured. Remote clients are assigned the entire 10.0.95.0/24 subnet while LAN 192.168.1.0/24 subnet.

No troubles for the remote subnet to access the internal LAN but cannot find a way to make internal LAN access SSL clients. I've tried to set a specific policy to enable traffic from LAN to SSL subnet but it seems to be ignored. Also, the route isn't correct because if I make a tracert from an internal LAN device pointing to a remote client it seems that the FortiGate sends the packet to the outside instead of redirecting them to the remote client through the tunnel interface. What I am missing? 

 

Thank you

 

This is the policy that I tried:

Schermata 2023-02-15 alle 11.24.48.png

Best answer by gfleming

Bugs happen. It could be you are hitting one. 

 

Without support you cannot talk to TAC nor can you run a supported FortiOS version. Right now you are exposing yourself to a lot of risk from a vulnerability, functionality and accessibility standpoint. 

 

Please get support renewed on your Firewall and get it updated ASAP.

5 replies

amouawad
Staff
amouawad
Staff
February 15, 2023

Try creating a static route for the 10.0.95.0/24 subnet to point to the SSL interface. The FGTs  don't populate the routing table with the subnets you've created for the SSLVPN.

 

amouawad_0-1676462828398.png

 

kaika313
kaika313Author
New Member
February 15, 2023

Hi @amouawad,

thank you for your reply.

Unfortunately, even with static route it doesn't work. Packets keep going outside instead of going to the right place. What else I can try to change/check?

Thank you

Schermata 2023-02-15 alle 15.07.30.png

 

 

gfleming
Staff
gfleming
Staff
February 15, 2023

Are you sure its the Fortigate blocking? Perhaps there is a local Firewall on the endpoint?

kaika313
kaika313Author
New Member
February 16, 2023

Hi,

 

I've disabled every possible firewall anywhere including Windows firewall and remote router's firewall with no success. Strange thing is that even from CLI console I cannot ping and reach clients...

funkylicious
SuperUser
funkylicious
SuperUser
February 16, 2023

I tested myself w/o a static route configured on the FW ( 200E 6.4.9 ) to reach my machine connected in SSLVPN and works just fine from the FW and a device behind it.

Maybe it's time to upgrade the firmware, 6.0 is very old :) 

"jack of all trades, master of none"
kaika313
kaika313Author
New Member
February 16, 2023

Yes, maybe it's a firmware issue but as the support license expired unfortunately there's no way to test the connection with an updated firmware version... but despite OS version it should work anyway because everything is configured properly!

gfleming
Staff
gflemingAnswer
Staff
February 16, 2023

Bugs happen. It could be you are hitting one. 

 

Without support you cannot talk to TAC nor can you run a supported FortiOS version. Right now you are exposing yourself to a lot of risk from a vulnerability, functionality and accessibility standpoint. 

 

Please get support renewed on your Firewall and get it updated ASAP.

amouawad
Staff
amouawad
Staff
February 16, 2023

Could you try enabling NAT on the LAN > SSL policy and test again?

kaika313
kaika313Author
New Member
February 16, 2023

Also tried this, but it's not working

gfleming
Staff
gfleming
Staff
February 16, 2023

You're running end-of-support FortiOS code on that Firewall. Strongly suggest you first upgrade to something supported (6.4 at least, 7.0 ideally). 

 

Then if the problem persists we start troubleshooting again.

Terms & ConditionsAccessibility statement