Access VIP from ssl vpn of the same device

[2plus-bzone]

Hello,

I have a customer that have a few sites with NVR that he access them by the external IP (VIP) but only from specific address. he wants to see all the sites from his app at the same time.

For that I configured him in his 40F Fortigate a SSL VPN with tunnel mode disabled on his main site and it's work fine and he can see all his sites, but he can't see the main site NVR.

In the main site we have 2  ISP WAN: Optical line and VDSL line

The VIP for the NVR is configured for the optical line and we have access from IP that authorised in the policy, but can't access when we try after connect to the SSL VPN.

When I check my external ip address when I connect to the SSL VPN I get the external ip of the VDSL line, the VDSL external IP address is authorised in the VIP policy.

I checked with packet capture where I get block and I got very strange results:

1. From my pc (out of the sites of course ) I get in ssl vpn external IP of the VDSL line but in the packet capture I found that the FGT see my real external IP and block me becuase my ip not authorised - when I add my real IP I had an access.

2. From my phone (connect to cellular not wifi) I get in ssl vpn external IP of the VDSL line but in the packet capture I found that FGT see I come from ssl tunnel address (10.212.134.200) and no matter what I tried I don't have access to the NVR (to the local IP of the NVR I have access)

IP
Source IP	10.212.134.201
Source Port	57060
Destination IP	81.199.193.66
Destination Port	81
Protocol	TCP

L4
Sequence Number	4205875282
Ack
Flags	SYN
Window	65535
Length	0
Checksum	0x7c1c

Does anyone have a solution for this?
Why is there a difference between a computer and a phone?
How does the FGT see the real IP and how can it be bypassed?

How I can access the VIP NVR if it show I come from ssl address? I tried to add the ssl tunnel adderss to source address in the policy but it didn't work

[Anthony_E]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Debbie_FTNT]

Hey 2plus-bzone,

can you please clarify the VPN component of your setup a bit? At one point you mention that tunnel-mode is disabled, but at another you mention that the phone you tested with received a tunnel IP?

In general, VIPs can be added to SSLVPN policies, but only for purely tunnel-mode setups; it will not work with web-mode. Two articles to illustrate this a bit better:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-access-a-VIP-from-a-SSL-VPN-tunnel-...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Adding-groups-to-SSLVPN-policies-with-VIPs...

For your PC vs phone discrepancy - it sounds as if traffic from PC to VIP is not routed through the VPN tunnel for whatever reason, so it hits the FortiGate with public IP, whereas the phone traffic is routed through the tunnel (so hits with tunnel IP). We would need a better understanding of your SSLVPN setup (web-mode vs tunnel-mode, split-tunnelling or no, routing/DNS through tunnel...) to provide a better response.