Cannot connect from inside network to connected VPN clients

[#1]

Currently we have a Fortigate-60 running 2.80 build 318. When a user connects via the FortiClient, they can connect to everything in the internal network as expected. However, I cannot initiate connection back to the client. In other words, I cannot VNC from inside the network, to a connected client. It looks as those the Fortigate is dropping the connection attempt. Is this by design, or am I missing a firewall policy somewhere?

[wcbenyip]

Hi Magnus, Bi-directional traffic should works in your scenario. Some hints for your troubleshooting: 1/ Your VPN fw policy is enabled Inbound & Outbound option? 2/ The address for your vpn client is set to 0.0.0.0? 3/ Your host is on the same subnet of the destination network for the vpn policy? 4/ What' s the last host before time out in traceroute the vpn client' s internal ip? 5/ Are you sure the internal IP of the vpn client do not conflict with your internal subnets? Hope that it could help~

[#3]

1) I' m not sure what you mean by is enabled for inbound and outbound. I currently have connection from " Internal" to " Wan1" encrypted for my internal subnet 10.0.0.0/24 to 10.0.0.0/24. I do not have something that goes from " Wan1" to " Internal" except for an unencrypted 10.0.0.0/24 to 10.0.0.0/24. 2) No, FortiClient VPN clients grab DHCP address from the internal DHCP server via DHCP relay. 3) VPN Clients get a 10.0.0.0/24 address from the DHCP, as do the internal hosts. 4) Trace' s die at the FortiGate F60 (VPN Endpoint) with a destination Host Unreachable. 5) There are no IP conflicts as far as I know.

[#4]

Magnus, did you ever figure out what the problem is? I am having the same exact problem with the Fortigate-60 as well. VPN traffic initiated from client is fine, but vice versa is not. From inside the Fortigate-60, what was the last IP address in a traceroute to the client' s internal IP address? I find it kind of strange that it jumped from the Fortigate-60' s internal IP address to the WAN gateway. Shouldn' t the next hop be the IPSec gateway or the VPN client' s IP address?

[#5]

Magnus, Not sure if this will help you or not, but I got my problem figured out. I figured out it was a routing issue. I think that' s the case with your problem as well. You said that the VPN client is getting an IP address from the Fortigate-60, right? Do you have an IP address range that the Fortigate-60 gives out to diallup VPN clients? You will need to create a routing policy so it knows how to redirect traffic once it hits the Foritgate router. Your routing policy will be a little trickier since your VPN clients and internal hosts are on the same subnet.

[#6]

Magnus, The VPN clients should have an address DIFFERENT from your existing clients on the network. In your case you have inbound NAT enabled thus it is impossible to reach VPN clients from your network. Check other threads (on which I commented) and you' ll find the answer Cheers, Eric