Can't connect to SSL VPN from local network

[CTLCoppens]

I have set up SSL VPN for a client. Users can connect from external location without issue so it is fully working.

I need 1 user to also be able to connect to the VPN from inside the internal network. Forticlient just gives a message that the VPN server is not reachable.

I have set up VPN in our own network in the same manner and I can connect to the VPN from our internal network without issue.

I can't seem to find the difference in configuration that makes it possible in our own network but not in the clients network. Could someone point me in the right direction please?

[UrbyTuesday]

are you using a hostname or IP address when configuring Forticlient VPN?  If using a hostname, try an IP address.

[CTLCoppens]

I'm using IP address.

[smallbox]

SSL-VPN Setting | Listen on Interfaces ( I have the Interface in that group ) Can you see that interface they are connecting in from? The https://default Gateway should be below in the windows.......

I am also trying to set up internal Client connecting through the SSL-VPN and having issues...

It appears to not have any DOC referencing internal use?

Tunnel mode create IP ranges with the group and interface.

the SSL-VPN Portals group as well...  

My PA220 I have the Outside IP as the Main Portal, then the gateways are assigned to the  Interface the users are connecting from.... So I am guess this should be similar, the certificates get a little tricky..... Still figuring this out!

[CTLCoppens]

Listen on interfaces is set to "any". Not sure what you mean by The https://default Gateway should be below in the windows.

[smallbox]

in the dialog box in the setting for the SSL-VPN setting "ensure the Interface IP address is present, under the Listen on port "web mode access will be listening at "https://xxx.xxx.xxx.xxx:10443" not sure if that help... 

[sagha]

Hi CTLCoppens, 

I would suggest running a sniffer on FGT first. 

diag sniffer packet any 'host x.x.x.x and port yy' 4 0 a 

Replace x.x.x.x with host IP and port with destination port for sslvpn

Check if traffic is reaching the FGT or not. 

If it is, then run a debug flow 

diag de reset

diag de flow filter clear

diag de flow filter addr x.x.x.x 

diag de flow filter dport yyy

diag de flow trace start 1000

di de en

This would show that when you are connecting via internal network, how FGT is dealing with traffic. 

If this shows that traffic is not dropped, please run sslvpn debugs: 

diag de reset

diag de application sslvpn -1

diag de en

Share all the debugs here, we can have a deeper look into it then ;)

Thank you. 

Shahan

[smallbox]

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/179703/ssl-vpn-tunnel-mode-host-check

[CTLCoppens]

id=20085 trace_id=309 func=print_pkt_detail line=5665 msg="vd-root:0 received a packet(proto=6, 192.168.1.5:55408->15.15.1.25:10443) from dmz. flag [S], seq 990713053, ack 0, win 64240"
id=20085 trace_id=309 func=init_ip_session_common line=5836 msg="allocate a new session-096618b2"
id=20085 trace_id=309 func=vf_ip_route_input_common line=2584 msg="find a route: flag=04000000 gw-192.168.10.1 via wan1"
id=20085 trace_id=309 func=fw_forward_handler line=796 msg="Allowed by Policy-3: SNAT"
id=20085 trace_id=309 func=__ip_session_run_tuple line=3453 msg="SNAT 192.168.1.5->192.168.10.2:55408"
id=20085 trace_id=309 func=ipd_post_route_handler line=490 msg="out wan1 vwl_zone_id 0, state2 0x0, quality 0.

Is what I get for the debug flow. Ip's are fictitious but representative. I know this test was from inside the DMZ but same thing from the normal internal LAN. Setup is a modem in bridge mode with a fortigate behind it.

As for as I can tell the trafic is directed outside through the modem and thats why it is not working. 

SSL VPN debug shows nothing cause it never starts to negotiate with the SSL VPN.

[smallbox]

in the config, 

CLI | show vpn ssl setting |  and 

To check the tunnel log in using the CLI: get vpn ssl monitor

Did you look at this yet?

The default portal appears to be at WebAccess