Technical Tip: SSL VPN configured with an address range the same as the Internal Subnet

[Hasnatriad]

Description	This article describes a configuration scenario where customers configure the SSL VPN address range to be the same as the Internal subnet and cannot access the internal servers.
Scope	FortiGate.
Solution	Configuring SSL VPN in FortiGate requires users to create an address range for SSL VPN users. Some customers use the same range as the internal subnet. Note that using same subnet for internal network and SSL VPN is not recommended.  It is highly suggested to use different subnet per network to avoid conflict on routing ang switching. Configuration example for SSL VPN: Internal Subnet: Policy for SSL Traffic: With this configuration, SSL VPN users can connect and receive an IP address from the assigned range.  SSL VPN user address assignment: However, despite being connected to the SSL VPN, the user cannot access the internal servers as, in the policy, NAT is disabled. The traffic is not forwarded to the gateway since the SSL VPN assigned IP and LAN IP are in the same subnet. To mitigate this issue, NAT should be enabled in the policy. Enabling the NAT servers forwards the traffic to the FortiGate interface IP; FortiGate performs NAT and forwards toward the VPN user IP. Enable NAT in the firewall policy as mentioned below : If it still fails, refer to Troubleshooting Tip: SSL VPN Troubleshooting for SSL VPN debugging. Related article: Technical Tip: How to configure specific SSL VPN address pool to SSL VPN Users/Usergroup