Access to SSL VPN clients from internal network

[#1]

Hi, in my company, we are using SSL VPN to access to internal network. And all is working fine, but I need to access to these remote clients from the internal network using the virtual ip assigned in the ssl tunnel. Is this possible? Now, I' m doing a ping at this ip and is not responding. We have Fortigate 200. Thanks in advance.

[rwpatterson]

It is possible, but you have to do a bit of work first. Assign the SSL VPN clients NAT IP addresses in the group policies, then create a policy that allows internal > SSL VPN subnet/range. This works here for us without a problem. Get the ports right, and you' re done.

[#3]

Hi, I don' t understand what do you refer when you say " Assign the SSL VPN clients NAT IP address in the group policies" . Do you refer, that I have to asign to the SSL VPN clients IP from the internal range?. Thanks for all.

[#4]

Hi, Bob thank you for the answer. But I don' t achieve that the clients be visibles from internal network. Could you guide me how implement the solution? Thank you.

[rwpatterson]

When you create the group in " User > User Groups > Advanced" section assign them an IP tunnel range. Then in the policy, just refer to this range in the destination.

[tmoe]

Bob, Can you elaberate on this setup? I have the SSLVPN setup like this. Internal network 172.16.0.0/24 VPN Range 172.16.2.200 - 254 I' m trying to add a rule to allow my internal network to ping the clients using the SSLVPN.

[rwpatterson]

Set up a policy from source internal port, <ip address range for inside subnet.> to destination external port, <ip address range for SSL VPN subnet.>, service ping. You need to have the two address entities defined first under " Firewall, Address" .

[#8]

In the policy, Do I have to configure in action " SSL-VPN" ? or other parameter? Because, It don' t work! This is my policy configurattion : Source : Internal> IP' s of My Network (10.1.0.0/24) Destination: WAN1> ip address range for SSL VPN subnet (10.1.0.132-10.1.0.140) Service: Any

[rwpatterson]

See my reply to your email.