Allow FortiClients to communicate to each other??

[Rob_G]

Looking to allow remote FortiClients to talk to each other. An example is, I'm remote on FortiClient and I need to RDP to another FortiClient via RDP.

I've created a rule to allow SSL_VPN_TUNNEL addresses and SSL_VPN_USERS to talk to SSL_VPN_TUNNEL addresses using the ssl.root.tunnel interface as the source and destination. Even moved this policy to be first in line. No Windows firewall or FC firewall enabled. Connection is showing as passed in the logs. Anyone have any thoughts on this?

Thanks in advance,

Rob

[seadave]

Our rule looks as attached.  Seems to work for our Shoretel/Mitel softphones.

config firewall policy     edit 207         set name "SSLVPN - Mitel"         set srcintf "ssl.root"         set dstintf "ssl.root"         set srcaddr "SSLVPN_TUNNEL_ADDR1"         set dstaddr "SSLVPN_TUNNEL_ADDR1"         set action accept         set schedule "always"         set service "ALL_ICMP" "ALL_TCP" "ALL_UDP"         set logtraffic all         set groups "SSL_VPN_FULL"     next end

This rule obviously could be restricted but what we have now to make this work for folks.

[Yanis_Sauve]

My rule is exactly the same:

edit 88 set name "VPN->VPN" set uuid 883799fa-6dd9-51ea-53d2-a9f70a93b2f1 set srcintf "ssl.VDOM-CSDLJ" set dstintf "ssl.VDOM-CSDLJ" set srcaddr "VPN-Clients-172.17.6" set dstaddr "VPN-Clients-172.17.6" set action accept set schedule "always" set service "ALL" set groups "AAA-GRP-VPN" next

VPN-Clients-172.17.6 is defined as range 172.17.6.4-254

But poilcy 88 is never hit by anything.  And I just can't get anything from flow trace.

[seadave]

Only think different I see is you are using a specific vdom but that shouldn't matter.  You might open a ticket with the TAC.  They are good at getting into diag debug flow and figuring these things out.  One other thing is that we are showing ALL_ICMP, ALL_UDP, etc.  Those might differ from the ALL you are using.

[Yanis_Sauve]

Well, some news.

I changed my clients ip range from 4-254 to 10-254 and this seems to have fixed it.

Everything works correctly now, and my policy is being hit.

Thanks for the help guys.

[kulas]

I have the same concern.. I tried to use SUBNET instead of IP RANGE for my clients. I do also have firewall policy in placed ssl.root-to-ssl.root but no traffic hit. I do also debug flow and packet sniffer but no avail.

Regards,

Kulas

[Nik]

I do have this problem also. I have configured the policy correctly but still there is no access to each other. One thing what I did observe was that for every vlan created on the fortigate there is a connected route under the Routing monitor. But interesting the route to the sslvpn is not present. When I do a route lookup for example, destination 10.10.1.4 (sslvpn IP address) from the LAN gateway 172.16.16.1, the hit I got was via the default route 0.0.0.0/0 via internet gateway! BUT this leads to nowhere since there is no public IP address for the destination and it will just end on the cyberspace somewhere. 

So what do you guys think if I create a static route from LAN to the sslvpn subnet, will then this help!

Has anyone succeeded with this and how?