Skip to main content
Rn34
Rn34
New Member
August 18, 2015
Question

SSLVPN access to sites across IPSec VPN

  • August 18, 2015
  • 3 replies
  • 13928 views

I'll try to keep this as clear as possible, but I need help getting SSLVPN traffic to route correctly to my remote sites accessed via IPSec. I can get into my home site (Site A) just fine, but any traffic past that never makes it. I've setup static routes on both ends, no effect. My policies should allow this, but it's possible I don't have this correct.

 

For this issue I have 3 sites (many more in reality): A, B, C. A is my main site where the SSL traffic starts. B/C are my remote sites. B will sometimes need to talk to C and vice versa. All interfaces are placed into zones and polices built on zones as follows:

 

[ol]
  • VPN Interfaces (ipsec) to Internal
  • Internal to VPN Interfaces
  • Internal to External[/ol]

    Site A has additional policies which are:

    [ol]
  • VPN to VPN.
  • SSL VPN to Internal/VPN[/ol]

     

    Now in theory that should allow any traffic from the SSL interface to travel out to it's destination. I've also tested with a policy that is: Internal to SSL, but it doesn't appear to be necessary.

     

    I was able to make this work when I added in an additional phase 2 selector on my IPsec tunnel (I don't understand why this is necessary). However, that only worked for tunnel mode, it did not work for web mode ssl.

     

    On the remote side I've added a static route that says to access the sslvpn subnet go through the 'site a' ipsec interface. I've also added it into the allowable addresses in the above 3 policies. This seems to have no effect.

     

    IPs:

    a: 10.10.10.0/24

    b: 10.10.20.0/24

    c: 10.10.30.0/24

    ssl: 10.10.100.0/24

     

     

    What am I doing wrong?

    • 3 replies

    Somashekara_Hanumant
    Staff & Editor
    Somashekara_Hanumant
    Staff & Editor
    August 23, 2015

    Hi,

     

    Firstly we need to check when a user tries to access remote VPN network from sslvpn client system, whether the traffic is entering into right tunnel or not.

     

    using below command you can check the same

     

    diag debug reset diag debug enable diagnose debug flow filter addr x.x.x.x diagnose debug flow filter proto 1 diag debug flow show console enable diag debug flow show function-name enable diag debug flow trace start 200

     

    where x.x.x.x is a remote vpn network.

     

    If the traffic is entering into correct vpn tunnel then, run the same commands on remote side fortigate unit to check whether the traffic is reaching or not

     

    If the traffic is reaching the correct tunnel and if the quick mode selector does not match, then the traffic does not reach

     

    You might need to check whether sslvpn tunnel range is configured on remote side quick mode selectors or not

     

    Hope this helps.

    vjoshi_FTNT
    Staff
    vjoshi_FTNT
    Staff
    August 23, 2015

    Hello,

     

    - IPSec VPN does not allow you the IP addresses which are not part of the phase2 quick mode selectors - In SSL-VPN (web mode), the user traffic reaches the destination with source as internal interface. Destination server(resource) never knows that the request is from the SSL-VPN client - SSL-VPN Web mode is a client less and has no IP address like in Tunnel mode - Tunnel mode is the best solution for this setup Personally, I haven't seen a setup with SSL-VPN web mode to be routed to the remote VPN, however you can try this : Say, you connect to SSL-VPN webmode on SiteA - On this SSL-VPN portal, add bookmarks of the resources that needs to be accessed on the SiteB/SiteC - Wan to Lan(SSL-policy should allow the traffic to SiteB/Site C IP addresses) and rest should be left as it is.

    Rn34 wrote:

    I was able to make this work when I added in an additional phase 2 selector on my IPsec tunnel (I don't understand why this is necessary). However, that only worked for tunnel mode, it did not work for web mode ssl.

     

    What am I doing wrong?

    Rn34
    Rn34Author
    New Member
    August 24, 2015

    vjoshi wrote:

    Hello,

     

    - IPSec VPN does not allow you the IP addresses which are not part of the phase2 quick mode selectors - In SSL-VPN (web mode), the user traffic reaches the destination with source as internal interface. Destination server(resource) never knows that the request is from the SSL-VPN client - SSL-VPN Web mode is a client less and has no IP address like in Tunnel mode - Tunnel mode is the best solution for this setup Personally, I haven't seen a setup with SSL-VPN web mode to be routed to the remote VPN, however you can try this : Say, you connect to SSL-VPN webmode on SiteA - On this SSL-VPN portal, add bookmarks of the resources that needs to be accessed on the SiteB/SiteC - Wan to Lan(SSL-policy should allow the traffic to SiteB/Site C IP addresses) and rest should be left as it is.

    Rn34 wrote:

    I was able to make this work when I added in an additional phase 2 selector on my IPsec tunnel (I don't understand why this is necessary). However, that only worked for tunnel mode, it did not work for web mode ssl.

     

    What am I doing wrong?

     

    - If the phase2 is setup as: 0.0.0.0/0, for both options on both sides of the connection, then why would it matter what network I'm trying to send down 'x' tunnel?

     

    - Interesting, I've been trying to diagnose what IP it would have in Web-mode. However, upon trying to access remote sites I simply get sslvpn proxy errors: access denied. This I've deduced must be a routing issue somewhere. Unfortunately due to how this is being setup it is ideal to have both methods of ssl VPN access.

     

     

     

    For reference I've also put in a technical request ticket with support. I'll try out the suggestions here as well and will update if I get a solution working.

     

    vjoshi_FTNT
    Staff
    vjoshi_FTNT
    Staff
    August 23, 2015

    Just to add, if the tunnel mode between any specific sites has issues, then make sure, both the IPSec phase2's has got the SSL-VPN subnet in the source and destination quick mode selectors as applicable

     

    Cheers!

    Terms & ConditionsAccessibility statement