Skip to main content
Javad_M
Javad_M
New Member
January 23, 2026
Question

SSL VPN Users fail to reach Local LAN

  • January 23, 2026
  • 1 reply
  • 184 views

We have a scenario in which we need an ssl vpn to our local network. The topology consists of two FortiGate FG-100F (HA) connected to two FortiSwitch FS-124F on port X1 and X2 of the Fortigates to SFP ports of the fortiSwitches. The fortiswitches are connected to each other on two MCLAG ports as well. We have a VLAN120 (10.60.100.0/24).
The ports X1 and X2 are under a fortilink interface. All local VLANs have been created under the FortiLink interface. We also setup SSL VPN (IP range 10.60.101.0/24). We have Policy to allow incoming traffic from ssl.root interface to VLAN 120. The users can successfully connect to the SSL VPN using FortiClient, and they receive ip from 10.60.101.0/24 range, however they can not ping a resource under VLAN120. FortiClient also shows zero Receive but it has sent traffic. I can confirm that traffic hit the firewall policy.

1 reply

AEK
SuperUser
AEK
SuperUser
January 24, 2026
  • Are the hosts on the subnet 10.60.100.0 singable from your FGT?
  • In traffic logs do you see the related traffic is accepted? If so then I guess it show the sent packets is positive number and received is zero bytes, right?
  • Run the below commands and then try to ping:
diag debug flow filter addr 10.60.101.x (IP addr of the VPN client)
diag debug flow show function-name enable
diag debug flow show iprope enable
diag debug console timestamp enable
diag debug flow trace start 500
diag debug enable

          Then share the debug output.

AEK
Terms & ConditionsAccessibility statement