AWS to SSL vpn

[Timur1]

Hi guys, i set up SSL vpn from fortigate to our AWS setup. we have 2 AWS accounts and i am able to reach resources in one account without any issues but not the other one. All the config is the same across both accounts.

on prem wifi is also going through fortigate and through that both AWS accounts are reachable and i am using the same LAN link as incoming interface for SSL vpn. 

any ideas of what could be the problem? thanks

[xshkurti]

@Timur1 
Follow this link and execute debug flow commands to check which policy is blocking your traffic:
Debugging the packet flow | FortiGate / FortiOS 7.4.1 | Fortinet Document Library
Executing debug flow commands, you will find matching policy and try to edit that one.

[Timur1]

Hi, thank you for your reply. as per the logs ec2 server on AWs is reachable and i am receiving packets. but if i try to RDP to the server or ping to it that still doesn't work (both RDP and ping are allowed for the server) 
what am i missing? it should work but its not

[xshkurti]

@Timur1 
Can you please send here the output of below commands?
dia de dis
dia de reset
dia de flow filter add x.x.x.x    ----- replace x.x.x.x with the IP address of EC2 instance
dia de flow filter port 3389    ----- or what port are you using for RDP to EC2
dia de flow show iprope en
dia de flow show funct en
dia de flow trace start 20
dia de en

After above commands are executed, please try to connect via RDP.
Above commands will generate some output which will tell what the traffic is being blocked (if it is blocked by fortigate or not)

[Timur1]

Hi, i have the output 
is there a way that i can share that with you one on one? or do i need to post it here? thank you for help btw)) greatly apprecaited 

[xshkurti]

@Timur1  in this forum we can not communicate one-to-one, but feel free to open a support ticket with your output and our team will follow your case.

In case you are not covered, please change all your IPs with some different IPs or your sensitive data and then post the output here

[Timur1]

xx

[Timur1]

this is what i am getting when i run RDP after the commands u shared

[xshkurti · Accepted solution]

So i see that traffic comes from ssl vpn to ipsec vpn from x.x.x.1 to x.x.x.2 on port 3389.
This traffic is allowed by policy "Allowed by Policy-29" and traffic leaves fortigate into tunnel
"enter IPSec interface Test VPN 2, tun_id=0.0.0.0" -- Traffic enters tunnel
"IPsec encrypt/auth"   --- Traffic is encrypted

"send to x.x.x.4 via intf-wan2" ---traffic is leaving fortigate via WAN2 interface.

It seems that there might be an issue with RDP on AWS side.
Can you check if RDP is enabled on EC2 Server? or if there is any policy in AWS that blocks RDP traffic?

[Timur1]

Thank you) i will check on aws side to see if there\s anything blocking this
i really appreciate your help) thank you