Access to remote subnet via VPN SSL with multiple Fortigate and MPLS

[5q46n2te8jPWJY]

Hi guys!

I want to submit use my actual issue.

 

I just configure SSL VPN on Fortigate A, and I want to join ressources connected behind Fortigate B. Fortigate A and B are connected trought MPLS. I added Fortigate B ressources subnet, but it is not sufficient.

Can you guide me?

Thanks for your opinion!

[AEK]

Hi

Did you add the route-back on FG-B?

I mean you need to add on FG-B a route towards Site-A-SSL-VPN-Subnet through MPLS interface.

Make sure SSL-VPN IP range of site 1 and site B are not the same.

Otherwise you can still enable NAT on the policy on FG-A (I prefer avoid it but just as quick workaround).

[hbac]

Hi @5q46n2te8jPWJY,

If you have split tunneling enabled, make sure you add FortiGate B subnet for SSLVPN split tunneling networks. On FortiGate A, you need a firewall policy to allow ssl.root to the MPLS interface. On FortiGate B, you also need to add SSLVPN subnet to the firewall policy if NAT is disabled and you need a static route to SSLVPN subnet. 

Regards,