New Member

Question

SSL VPN access only VLAN hosts directly connected to Fortigate

Forum|Forum|1 year ago
June 21, 2024
4 replies
3616 views

Hi there!

We are installing a new Fortigate 60F. It will be quite a basic configuration, we have 3 VLAN defined in a VLAN switch attached to a L2 switch port in trunk/tagged mode and have created several policy rules to allow traffic between them (working fine). We also have users connecting through SSL VPN (planning for IPsec in the near future), and also created the respective rules to allow traffic from the VPN network segments to the different VLANs.

We are not 100% sure if Fortigate is working as expected or we are missing some rule, since users connecting through SSL VPN can see/access only hosts directly connected to the Fortigate (fortigate as GW) and not all hosts in the VLAN.

Would appreciate if someone could shed some light on this.

Thanks in advance.

BR

Elmir

Explorer

For me, it seems you are missing some firewall rules. If possible, could you upload related config? Maybe I could help you.

cmohringAuthor

New Member

Hi @Elmir, thanks for your response:

Interface definition:

    edit "ssl.root"         set vdom "root"         set allowaccess ping         set type tunnel         set alias "SSL VPN interface"         set role lan         set snmp-index 7     next     edit "LAN"         set vdom "root"         set allowaccess ping https ssh         set type hard-switch         set device-identification enable         set role lan         set snmp-index 9         set ip-managed-by-fortiipam disable     next     edit "VLAN Sup"         set vdom "root"         set ip 192.168.200.254 255.255.255.0         set allowaccess ping https ssh http         set device-identification enable         set role lan         set snmp-index 17         set ip-managed-by-fortiipam disable         set interface "LAN"         set vlanid 200     next     edit "VLAN Est"         set vdom "root"         set ip 10.1.1.254 255.0.0.0         set allowaccess ping https ssh http         set device-identification enable         set role lan         set snmp-index 18         set ip-managed-by-fortiipam disable         set interface "LAN"         set vlanid 1     next     edit "VLAN Dev"         set vdom "root"         set ip 192.168.220.254 255.255.255.0         set allowaccess ping         set device-identification enable         set role lan         set snmp-index 8         set ip-managed-by-fortiipam disable         set interface "LAN"         set vlanid 220     next

Address definition:

    edit "VPN Est Network"         set subnet 172.120.0.0 255.255.255.0     next     next     edit "VLAN Est"         set subnet 10.1.1.0 255.0.0.0     next

Policy rule:

    edit 3         set name "SSLVPN Est"         set srcintf "ssl.root"         set dstintf "VLAN Est"         set action accept         set srcaddr "VPN Est Network"         set dstaddr "VLAN Est"         set schedule "always"         set service "ALL"         set groups "Est"     next

Routing table:

get router info routing-table all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
V - BGP VPNv4
* - candidate default

Routing table for VRF=0
S* 0.0.0.0/0 [10/0] via 192.168.100.1, wan2, [1/0]
C 10.1.1.0/8 is directly connected, VLAN Est
C 192.168.100.0/24 is directly connected, wan2
C 192.168.200.0/24 is directly connected, VLAN Sup
C 192.168.220.0/24 is directly connected, VLAN Dev

Hope this helps.

hbac

Staff

Hi @cmohring,

Your firewall policy "SSLVPN Est" only allows traffic to one VLAN. If you want to allow more VLANs you need to add those VLANs to the policy or create new policies.

Regards,

cmohringAuthor

New Member

Hi @hbac. Thanks for your response.

Yes, we have all other policies defined. I just posted one example, but all of them are on the same situation regarding the visibility to other hosts in their own VLAN.

BR

cmohringAuthor

New Member

Hi again.

We found out that when we configure the policy rule with NAT enabled, we can see al devices in the VLAN Est (not only those connected directly to FG). Same applies to other VLANs.

Surprisingly, with NAT enabled we lost communication to our Exchange server (VLAN Est, not connected to FG). So somehow this rule from ssl.root to VLAN Est is affecting traffic to WAN interface.

Will keep you posted if we find out something else.

Pittstate

Explorer

Go to Network > Diagnostics > Debug Flow and use that to trace the packet flow through the FG. You'll probably want to use Advanced to control the amount of traffic captured by setting the source/destination IP addresses. This should give you an idea of where things are failing.

cmohringAuthor

New Member

Hi @Pittstate.

I checked the Debug Flow, but I only get sent packets matching a policy:

24/06/2024 9:55	vd-root:0 received a packet(proto=1, 172.120.0.1:1->10.1.1.6:2048) tun_id=0.0.0.0 from ssl.root. type=8, code=0, id=1, seq=293.
24/06/2024 9:55	allocate a new session-000605d7
24/06/2024 9:55	in-[ssl.root], out-[]
24/06/2024 9:55	len=0
24/06/2024 9:55	result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000
24/06/2024 9:55	find a route: flag=04000000 gw-10.1.1.6 via VLAN Est
24/06/2024 9:55	in-[ssl.root], out-[VLAN Est], skb_flags-02000000, vid-0, app_id: 0, url_cat_id: 0
24/06/2024 9:55	gnum-100004, use int hash, slot=64, len=2
24/06/2024 9:55	checked gnum-100004 policy-3, ret-matched, act-accept
24/06/2024 9:55	ret-matched
24/06/2024 9:55	gnum-4e20, check-ffffffbffc02c594
24/06/2024 9:55	checked gnum-4e20 policy-6, ret-no-match, act-accept
24/06/2024 9:55	checked gnum-4e20 policy-6, ret-no-match, act-accept
24/06/2024 9:55	checked gnum-4e20 policy-6, ret-no-match, act-accept
24/06/2024 9:55	gnum-4e20 check result: ret-no-match, act-accept, flag-00000000, flag2-00000000
24/06/2024 9:55	policy-3 is matched, act-accept
24/06/2024 9:55	after iprope_captive_check(): is_captive-0, ret-matched, act-accept, idx-3
24/06/2024 9:55	after iprope_captive_check(): is_captive-0, ret-matched, act-accept, idx-3
24/06/2024 9:55	after iprope_captive_check(): is_captive-0, ret-matched, act-accept, idx-3
24/06/2024 9:55	after iprope_captive_check(): is_captive-0, ret-matched, act-accept, idx-3
24/06/2024 9:55	Allowed by Policy-3:

I'm afraid there is no logical return path.

Pittstate

Explorer

Well, your "VPN Est" to "VLAN Est" rule seems to work and gets matched.

If you set source and dest addresses, you might not see the return traffic, depending on how those were entered.

I know you've probably double checked this but the reverse rule is entered and correct?

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded