Troubleshooting Tip: IPSEC Dial-up VPN over VIP to access the specific websites

[kmohan]

Description

This article describes how to troubleshoot the issue with traffic flow from IPSEC Over VIP Configuration.

Scope

FortiGate.

Solution

Once the configuration is done, run the below command line to verify the VIP address configured on IP-POOL.

Open the CLI and run the following:

diagnose debug flow filter addr x.x.x.x
diagnose debug flow show function-name enable

diagnose debug flow show iprope enable
diagnose debug flow trace start 200
diagnose, debug, enable

Verify the debug logs, verify with Policy (IPSEC to Lan), and IP POOL, if VIP is added on the multiple policies with outgoing 'Wan Interface'.
Check If the WAN interface is associated with VIP policy or not, then specify with IPSEC Interface instead of WAN Interface on IP POOL.

Change from Wan interface to Specific IPSEC dial-up interface on the IP POOL; same change on the policy also. Now, disconnect the FortiClient VPN and re-connect it. Once the VPN is connected, the specific URL will be accessible.