I have a customer that have a few sites with NVR that he access them by the external IP (VIP) but only from specific address. he wants to see all the sites from his app at the same time.
For that I configured him in his 40F Fortigate a SSL VPN with tunnel mode disabled on his main site and it's work fine and he can see all his sites, but he can't see the main site NVR.
In the main site we have 2 ISP WAN: Optical line and VDSL line
The VIP for the NVR is configured for the optical line and we have access from IP that authorised in the policy, but can't access when we try after connect to the SSL VPN.
When I check my external ip address when I connect to the SSL VPN I get the external ip of the VDSL line, the VDSL external IP address is authorised in the VIP policy.
I checked with packet capture where I get block and I got very strange results:
1. From my pc (out of the sites of course ) I get in ssl vpn external IP of the VDSL line but in the packet capture I found that the FGT see my real external IP and block me becuase my ip not authorised - when I add my real IP I had an access.
2. From my phone (connect to cellular not wifi) I get in ssl vpn external IP of the VDSL line but in the packet capture I found that FGT see I come from ssl tunnel address (10.212.134.200) and no matter what I tried I don't have access to the NVR (to the local IP of the NVR I have access)
Does anyone have a solution for this? Why is there a difference between a computer and a phone? How does the FGT see the real IP and how can it be bypassed?
How I can access the VIP NVR if it show I come from ssl address? I tried to add the ssl tunnel adderss to source address in the policy but it didn't work
For your PC vs phone discrepancy - it sounds as if traffic from PC to VIP is not routed through the VPN tunnel for whatever reason, so it hits the FortiGate with public IP, whereas the phone traffic is routed through the tunnel (so hits with tunnel IP). We would need a better understanding of your SSLVPN setup (web-mode vs tunnel-mode, split-tunnelling or no, routing/DNS through tunnel...) to provide a better response.
+++ Divide by Cucumber Error. Please Reinstall Universe and Reboot +++
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.