Technical Tip: SSL VPN Client receives IP address outside of the given SSL VPN IP address range

[hjhajj]

Description	This article describes how to resolve the issue in which FortiClient or SSL VPN Client is assigned with an IP address that does not come under the specified SSL VPN IP address range under SSL VPN Settings.
Scope	FortiGate SSL VPN.
Solution	If a FortiClient receives an IP address outside of the SSL VPN IP address range. Confirm the IP address range under SSL VPN Settings if it is the required one or not. If the IP address range under SSL VPN Settings is correct, check the Source IP Pool under SSL VPN Portal, the Source IP Pool Address Range must be the same as the SSL VPN Address Range under SSL VPN Settings. To check the address range through the CLI run the following commands:  SSL VPN settings: FortiGate3 (root) # config vpn ssl settings FortiGate3 (settings) # show config vpn ssl settings set banned-cipher SHA1 SHA256 SHA384 set servercert "Fortinet_Factory" set login-block-time 120 set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1" set tunnel-ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1" .... end  SSL VPN portal: FortiGate3 (root) # config vpn ssl web portal     FortiGate3 (portal) # edit "full-access"         FortiGate3 (full-access) # show         config vpn ssl web portal         edit "full-access"         set tunnel-mode enable         set web-mode enable         set ip-pools "SSLVPN_TUNNEL_ADDR1"         set split-tunneling-routing-address "lan"     next end