Can't Access VPN Tunnels Via FortiGate Client IPsec VPN

[TheUnhealthyComputer]

Hi Guys,

I recently setup a client IPsec VPN on my FortiGate 80D running firmware v5.0, but it doesn't seem to be working properly. My goal is to access two VPN tunnels via the client VPN. Unfortunately, when I connect to the client VPN I'm unable to access anything over the two VPN tunnels. While connected to the Client VPN, I have no issues accessing the Internet.

Here's some information that might be useful

[ul]

The FortiGate is running on the 10.100.100.0/24 subnet.

The Client VPN is running on the 10.100.32.0/24 subnet.

An address entry was created on the FortiGate for the 10.100.32.0/24 subnet under the name "Client VPN".

A static route was created on the FortiGate for the Client VPN.

Two separate policy rules were setup on the FortiGate, each allowing access to a VPN Tunnel (see screenshot below).[/ul]

Here's a screenshot of my policy setup

I was hoping to find some useful information about this issue on Google, but the only thing I could find was people asking how to access VPN tunnels trough a SSL VPN, not an IPsec VPN. If anyone could guide me in the right direction, I would very much appreciate it .

Thank You!

[Toshi_Esumi]

Please explain a little more about your environment. Did you mean "FortiClient on PC/Mac,etc." by Client VPN? Or the client is a router/FW device and setting up "dialup" vpn?

[brycemd]

Did you add the client VPN subnet to the phase 2 on the site to sites?

[ipbloke]

Hi There,

I have not tried this myself though if I am reading your post correctly then are you saying that the following is occurring ?

VPN Client ---> FW ---> Internal Network ------------------ Works correctly (You can access internal networks)

Internal Networks ---> FW ---> VPN Client ----------------- Does not work. (You can't access remote clients)

I struggled setting up my IPSEC VPN initially for remote access though I found the following link was useful:

http://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-ipsecvpn/Phase_2/Basic_Phase2_Setting...

Basically there is a statement at the bottom which says:

The workaround is to use multiple Phase 2s. If the configuration is FGT <-> FGT, then the better alternative is to just use 0.0.0.0 <-> 0.0.0.0 and use the firewall policy for enforcement.

I found that setting this in the Phase 2 selectors section  of my IPSEC Tunnel config made it easier to control access via standard FW policy.

I can't speak with authority on this and I am sure their will be loads of others who have done what you are trying to do though its worth ensuring this is set up correctly.

Fingers crossed for you & apologies if this not the answer !

Matt