To reach other Networks with Forticlient VPN Connections

Question

Dear Poeple,Nice Sunday first:-)I put a picture to explain my behaviour better.I want connect with a forticlient to FG1 to reach their network and reach the Network from FG2 too.FG1 und FG2 have side to side VPN connections.I can ping only the FG1 networks and cannot reach the FG2 networks like in picture to the network 192.168.4.0/24.Does it possibele to reach other Networks with a Forticlient over VPN Connection or not? Phase 2 all FGs and FortiClient Network are 0.0.0.0/0.0.0.0 typedIn FortiClient VPN Connections are both Network (192.168.4.0 and 192.168.5.0) typed.In FG 1 is a policyincomming: FortiClientVPNoutgoing: internal, VPN Connection to FG2incomming Network: alloutgoing Network: 192.168.4.0 and 192.168.5.0Split Tunneling ist activatedThanx in advantage

vdralio · Accepted Answer

Dear Kaplan,

You can check the article below if you have dial-up VPN users that want to reach a local subnet through S2S VPN:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Dialup-IPsec-traffic-forwarding-to-site-to-site/ta-p/192062

Best Regards,

Vasil Dralio

sw2090 · Answer

it is possible even with IPSec FortiClient VPN. You just need Policies on both FGT to allow the traffic and routing back to the vpn probably.

And you should enable split tunneling to have the FortiClient push a route to those subnets to the client. It would work without too but then ALL your traffic would go through the tunnel.

So in your case that would mean:

the dial up vpn on the 192.168.5.0 FGT should have split tunneling enabled with 192.168.5.0/24 and 192.168.4.0/24 as subnets (and p2 selectors set to 0.0.0.0/0.0.0.0).

This FGT then must have a route to 192.168.4.0/24 and a policy allowing traffic coing from the vpn to flow to 192.168.4.0/24.

The FGT in 192.168.4.0 has to have Policy that allows traffic coming from the vpn via the 192.168.5.0 FGT to flow to 192.168.4.0. Also it has to have a route back to the vpn net because without you will never get an answer to your packets :)

With all that set it should work.

You do not need reverse policies on both FGT as long as you don't want to be able to connect to a vpn client from out of 192.168.5.0/24 or 192.168.4.0/24.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded