Netmask preventing SSL VPN tunnel from working?

I think the 255.255.255.255 netmask is normal for this, so i think the problem is elsewhere. could be misconfigured of the local firewall is preventing the traffic. Also be careful that the client machine isnt on a 192.168.0.x network, else you will get routing issues as well.... thats the most common private subnet range unfortunately.

I' m seeing this post for the first time. First of all, it is clear that SSL VPN works. The network design you have is faulty. Basic rule: if your network range is 192.168.0.0/24 then any of your remote connections/networks are NOT. A SSL connection is a remote connection. So you define your SSL range like 172.19.1.0/24 then you can setup a routing to the ssl.root interface. Try it, and you' ll see. Cheers, Eric

Without that routing statement, the SSL ain' t gonna happen

Interesting. I know that you don' t write Fortigate documentation, but are you aware that there is no mention of creating a route of any kind in any of the Fortigate documentation on setting up an SSL network?

How far along in the process do you get?

It' s hard to characterize.

Basic rule: if your network range is 192.168.0.0/24 then any of your remote connections/networks are NOT. A SSL connection is a remote connection. So you define your SSL range like 172.19.1.0/24 then you can setup a routing to the ssl.root interface.

OK, I see I made a mistake. If you read the documentation carefully it does say that. However, I have the Fortigate managing an IPSec VPN which assigns IP addresses in my internal network range, and it seems to me that IPSec is a remote connection. So, starting again using 192.168.32.1-192.168.32.255 as my tunnel IP range and 192.168.0.0/24 is my internal network range. Let' s dive into Basic SSL Setup.pdf. " Under Advanced, define any internal DNS or WINS servers present in your network, ..." . OK, 192.168.0.250 is my DNS and WINS server, so enter that twice. Set up a user and user group ... check. I have LDAP working for IPSec but for now I' m just trying to get this going with a locally defined user. Define a firewall policy. Set the Source Interface to the interface that connects your FortiGate unit to the Internet .. OK, Wan1. Set the Source Address to all. Set the Destination Interface to the interface connected to your internal network ... OK, internal. Set the Destination Address to all. Set the action to SSL-VPN. Select the user group that you just added in the list on the left and select the right arrow to add that user group to this policy. Select OK. " Error: Destination address of split tunneling policy is invalid" . OK, turn off split tunneling for that user group, although I' ll certainly need it to put this into production, I' m not going to feed all traffic from a user in Israel or India or the Ukraine through me. Off to another tab to test ... OK, I can log in, and I can initiate tunnel mode and get connected. According to the manual " Access at this point requires either that users know the IP addresses of internal servers, or that your DNS server is configured to resolve internal machine names, also called netbios names, of those servers." Well, my DNS server at 192.168.0.250 is configured to resolve NetBIOS names, but let' s go to http://192.168.0.250 in a new tab. Internet Explorer cannot display the webpage. Ipconfig /all yields: PPP adapter fortissl: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : fortissl Physical Address. . . . . . . . . : DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes IPv4 Address. . . . . . . . . . . : 192.168.32.1(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.255 Default Gateway . . . . . . . . . : 0.0.0.0 DNS Servers . . . . . . . . . . . : 192.168.0.250 Primary WINS Server . . . . . . . : 192.168.0.250 Secondary WINS Server . . . . . . : 192.168.0.250 NetBIOS over Tcpip. . . . . . . . : Enabled Back to the " Welcome to SSL-VPN Service" tab. Test for reachability 192.168.0.250 returns reachable. Connect to Web Server 192.168.0.250 opens a new window with Remote Web Workplace displayed and https://192.168.16.16:10443/proxy/http/192.168.0.250/ in the address bar. Click on My Company' s Internal Web Site: Internet Explorer cannot display the webpage. https://192.168.16.16:10443/proxy/http/companyweb in the address bar. Gosharootie, seems to me that this is pretty useless and not operating as advertised. This message is a tad long, so I' ll continue on the next rock ...

All righty then, I' ll try the version presented in FortiGate_SSL_VPN_User_Guide_01-30007-0348-20080718.pdf. Setting up the VPN and the users and user groups is the same but with more explanations. On to the firewall policy ... On page 44 I see " In tunnel mode, it is necessary to create a DENY firewall policy that immediately follows the SSL VPN policy. If this policy is not created, SSL VPN tunnels will use other ACCEPT firewall policies. See the order of the Firewall policies below" . And in the picture below, they show three " internal -> external" policies. (It' s interesting that there' s no more mention of this required policy in the step-by-step instructions). " Note: If your destination address, SSL encryption, and user group are the same as for your web-only mode connection, you do not need to create a firewall policy for tunnel mode. The FortiGate unit uses the web-only mode policy settings except for the source address range, which it obtains from the tunnel IP range settings." OK, so all I need to do is configure Web-only. First I specify destination IP addresses: Go to Firewall > Address and select Create New. In the Address Name field, type a name that represents the local network, server(s), or host(s) to which IP packets may be delivered (for example, Subnet_1) ... OK, " SSL_Destinations" . From the Type list, select Subnet/IP Range. In the Subnet/IP Range field, type the corresponding IP address and subnet mask (for example, 172.16.10.0/24). OK, 192.168.0.0/255.255.255.0. Select OK. Huh? What interface do I select? I look down in the instructions for specifying destination IP addresses for tunnel mode, and I find " In the Interface field, select the interface to the external (public) network." Alright, select Wan1 and click OK. Now for the firewall policy. Create New. Source Interface/Zone: Select the FortiGate interface that accepts connections from remote users. OK, Wan1. Address Name select all. Destination Interface/Zone: Select the FortiGate interface to the local private network (for example, dmz). OK, Internal. Address Name: Select the IP destination address that you defined previously (for example, Subnet_1). Whoops, I can' t select that, it' s assigned to Wan1. Guess i should have selected Internal when defining the address group. Back to that page and change Wan1 to Internal. Now I can select it in the destination address name. No mention of schedule in the step-by-step instructions, guess I' ll select always. Service Any, Action SSL-VPN. SSL Client Certificate Restrictive un-checked, Cipher strength Any, User Authentication method Any, add my test group under Allowed, don' t touch anything else and click OK. Off to the SSL VPN tab, log in, activate tunnel mode. Ipconfig /all returns the same as before. All my tests yield the same result as before. Sigh. Rwpatterson says I need a static route, so off to that page. Static Route, Create new, Destination IP/Mask 192.168.32.0/255.255.255.0. Device ssl.root. Gateway goes inactive, contains 0.0.0.0. Distance I dunno, I' ll leave it at 10. Click OK. Back to the SSL VPN tab, log off, log in, active tunnel mode. Yippee! It' s exactly the same as before. Same ipconfig /all as before, can' t display http://192.168.0.250 except through the test on the SSL VPN page, can' t connect to htp://companyweb, can' t ping the server IP except through the SSL VPN page, can' t see my mapped network drives, can' t do much of anything useful. and as an extra bonus ... I can' t connect to anything on the Internet because split tunneling is off and I' m supposed to route all Internet traffic through the non-funcitonal VPN!!

First of all, it is clear that SSL VPN works.

That remains to be demonstrated. It' s not clear to me. I believe I' ve demonstrated that SSL VPN does not work if set up according to the Fortigate documentation.

OK, after changing policy 4 it is closer but not working. I get the login screen and successfully log in. None of the connections on the screen work, using my server' s 192.168.0.250 IP address. If I active SSL-VPN Tunnel it shows as connected, but after about 8 seconds it shows disconnected and then returns to the login screen. During that 8 seconds of connection ipconfig does not show the fortissl (or whatever it should be) adapter. I' ve tried modifying the Idle Timeout on the VPN | SSL | Config screen with no effect. I added an internal -> ssl.root firewall rule, with action Accept and with action SSL-VPN, and it had no effect.

Oh, carp. And I let the support run out. Now I have to pay ...