After changing a VLAN ... SSL VPN traffic is no more working

[tobi_m]

Hi all,

since i changed 2 internal vlan on a FortiGate 90G .... SSL is no more working.

SSL VPN is connecting, but no traffic is going throw. 

Does anyone have an idea? the firewall policy and also paket capture are not seing any Packets.

[Toshi_Esumi]

Please explain what did you mean by "changed 2 internal vlan" and what exactly you did. Otherwise nobody would have any idea what has changed in the SSL VPN environment.

Toshi

[tobi_m]

HI,

I deleted a interVLAN from unify hardware

added 2 new VLAN with the same Subnet as they was routet inside the interVLAN

Since that the issue appears.

It feels like the firewall is still routing to the old vlan interface. but its already deleted.

[amrit]

It would be very hard to answer your question without configuration details or knowing the change.Following are the few things that can be verified

1. You mentioned sslvpn users are able to connect so I  assume there is a valid sslvpn policy. However, if the split tunnel is configured, it is possible there is no policy for the destination traffic

2. Check the routing details for the destination Ip and make sure sslvpn to destination interface policy is present with user name/ group, source ip 

[mle2802]

Hi @tobi_m,

Can you please explain the problem in more detail? Do you mean that changing internal subnet and traffic is not flowing? Did you have policy from SSL to new VLANs? Can you please try to run debug flow when generating traffic:

diag debug reset
diag debug flow filter addr X.X.X.X (SSL VPN IP)
diag debug flow show func ena
diag debug flow show ip ena
diag debug flow trace start 999
diag debug ena

[nathan_h]

You mentioned that you are not seeing the packet on the Fortigate, you may verify if FortiClient sent the packet out on the tunnel. If split tunnel is enabled, by default, it will be based on Firewall Policy Destination. You can enter the command below on the Windows PC if the destination is injected with SSLVPN tunnel.

netstat -r

[tobi_m]

Hi thanks for the tipp. i added the route in the SSL Portal. i can see the route with netstat -r but no traffic is going. 

Now it gets more worse. i could see that a User was able to connect and it worked. but for 75% of the Users its not working.

PS: i deleted a interVLAN from unify hardware

added 2 new VLAN with the same Subnet as the was routet inside the interVLAN

[HiralShah]

Hello @tobi_m 

Have you added new vlan on the FortiGate and you want to access that subnet when connected to VPN? for that can you please check if the  firewall policy is created for sslvpn to new vlan, also if split tunneling is enabled, make sure the routing address override in the sslvpn portal has new vlan subnet added.

[rahulkaushik-22]

Please specify the issue. What changes are made and what's not working after that?

1. You are not able to access any resources over the SSLVPN after the change or only the vlan modified?
2. Check whether routes of the modified vlans exist on the routing table of the Forticlient machine.

Route print
If they exist then run dia de flow to find out what Fortigate is doing with the traffic.
If they don't exist then check portal settings, and make sure the modified vlans network exists either in routing address override or destination field of the SSLVPN policy.
Note: Routing address override under portal has more preference over SSLVPN policy so use one of them.

I hope it helps.

Regards, 
Rahul Kaushik

[tobi_m]

Hi,

i deleted a interVLAN from unify hardware

added 2 new VLAN with the same Subnet as the was routet inside the interVLAN

since that, SSL is no more working (looks like a few users are able wo work! i can see it in the logs today)

The most Users are testing with Mobile Connections (IPv6) so i thougt maybe that is the issue. but now also Users with Fiber got the issue.

i added the Route to the Override. i can see the routes on the Clients. but still not working