I have set up SSL VPN for a client. Users can connect from external location without issue so it is fully working.
I need 1 user to also be able to connect to the VPN from inside the internal network. Forticlient just gives a message that the VPN server is not reachable.
I have set up VPN in our own network in the same manner and I can connect to the VPN from our internal network without issue.
I can't seem to find the difference in configuration that makes it possible in our own network but not in the clients network. Could someone point me in the right direction please?
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
are you using a hostname or IP address when configuring Forticlient VPN? If using a hostname, try an IP address.
I'm using IP address.
SSL-VPN Setting | Listen on Interfaces ( I have the Interface in that group ) Can you see that interface they are connecting in from? The https://default Gateway should be below in the windows.......
I am also trying to set up internal Client connecting through the SSL-VPN and having issues...
It appears to not have any DOC referencing internal use?
Tunnel mode create IP ranges with the group and interface.
the SSL-VPN Portals group as well...
My PA220 I have the Outside IP as the Main Portal, then the gateways are assigned to the Interface the users are connecting from.... So I am guess this should be similar, the certificates get a little tricky..... Still figuring this out!
Listen on interfaces is set to "any". Not sure what you mean by The https://default Gateway should be below in the windows.
in the dialog box in the setting for the SSL-VPN setting "ensure the Interface IP address is present, under the Listen on port "web mode access will be listening at "https://xxx.xxx.xxx.xxx:10443" not sure if that help...
Hi CTLCoppens,
I would suggest running a sniffer on FGT first.
diag sniffer packet any 'host x.x.x.x and port yy' 4 0 a
Replace x.x.x.x with host IP and port with destination port for sslvpn
Check if traffic is reaching the FGT or not.
If it is, then run a debug flow
diag de reset
diag de flow filter clear
diag de flow filter addr x.x.x.x
diag de flow filter dport yyy
diag de flow trace start 1000
di de en
This would show that when you are connecting via internal network, how FGT is dealing with traffic.
If this shows that traffic is not dropped, please run sslvpn debugs:
diag de reset
diag de application sslvpn -1
diag de en
Share all the debugs here, we can have a deeper look into it then ;)
Thank you.
Shahan
id=20085 trace_id=309 func=print_pkt_detail line=5665 msg="vd-root:0 received a packet(proto=6, 192.168.1.5:55408->15.15.1.25:10443) from dmz. flag [S], seq 990713053, ack 0, win 64240"
id=20085 trace_id=309 func=init_ip_session_common line=5836 msg="allocate a new session-096618b2"
id=20085 trace_id=309 func=vf_ip_route_input_common line=2584 msg="find a route: flag=04000000 gw-192.168.10.1 via wan1"
id=20085 trace_id=309 func=fw_forward_handler line=796 msg="Allowed by Policy-3: SNAT"
id=20085 trace_id=309 func=__ip_session_run_tuple line=3453 msg="SNAT 192.168.1.5->192.168.10.2:55408"
id=20085 trace_id=309 func=ipd_post_route_handler line=490 msg="out wan1 vwl_zone_id 0, state2 0x0, quality 0.
Is what I get for the debug flow. Ip's are fictitious but representative. I know this test was from inside the DMZ but same thing from the normal internal LAN. Setup is a modem in bridge mode with a fortigate behind it.
As for as I can tell the trafic is directed outside through the modem and thats why it is not working.
SSL VPN debug shows nothing cause it never starts to negotiate with the SSL VPN.
Created on 07-12-2022 09:35 AM Edited on 07-12-2022 09:44 AM
in the config,
CLI | show vpn ssl setting | and
Did you look at this yet?
The default portal appears to be at WebAccess
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1561 | |
1034 | |
749 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.