Dial UP Client VPN to Fortigate and forward outside IPSec tunnel

[marconet-22]

Hi 

I have an issue with change SSL to IPSec configuration.

I follow instruction to build FortiClient Dial UP connection.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiClient-Dialup-IPsec-VPN-Split-Tunneli...

I have an issue with split tunnel, on windows enviroment doesn't appear single routes that assign via split tunnel but only default router. From android trablet it seams work.

I am created n°2 policy,

1st Dial Up Tunnel -> Local LAN                                       OK

2nd Dial Up Tunnel -> to other IPSec tunnel                  KO

2nd policy doesn't work, in diag I see the packet sent but i can't receive answer

What can i test?

[funkylicious]

hi,

try on the Windows computer:

1. Uninstall the FortiClient from your computer.
2. Reboot your computer.
3. Install FortiClient again.

[AEK]

Hi Marco

Regarding the second policy that doesn't work,

When you do diag sniffer, do you see the packet is forwarded to the IPsec tunnel?

and do you see it reach the remote FortiGate? If so, what is the source IP of the packet that you see on the remote FGT? I mean usually we forget add a route back and a firewall policy that handles the dialup clients range.

[marconet-22]

I see the "syn" packet from tunnel IPSec but to remote gateway i don't see it.

[AEK · Accepted solution]

You should check the selectors (in IPsec config) on both FortiGates and firewall policies as well.

[yderek]

@marconet-22 

What is second policy looks like ?  you can paste here by using 

======================

show firewall policy xx ---> xxx will be your policy ID 

======================

Can you get sniffer of the packet along with the debug flow to check ? 

Open CLI window 1 on FortiGate 

======================

dia sniffer packet any 'host x.x.x.x and host y.y.y.y' 4 0 l  ----> replace x.x.x.x with source and y.y.y with desteination 

======================

Open CLI window 2 on FortiGate 

======================

diag de reset
diag debug flow filter clear
diag debug flow filter addr x.x.x.x y.y.y.y and  ----> make sure you have 'and' at end, this is logical operater 
diag debug flow show function-name enable
diag debug flow show iprope enable
diag debug flow trace start 1000
diag deb console timestamp enable
diag de enable

======================

Now send traffic that is should going from dialup tunnel towards to the ipsec tunnel and let debug run  

To stop the debug 

in CLI window 1 using 'ctrl +c'

in CLI window 2 using 

======================

dia de dis 

dia de reset 

======================

Attach them into file and upload to here 

[marconet-22]

Hi

I solved the issue, policy from DialUp-IPSec to tunnel IPSec mustn't NAT the source IP.

I can NAT traffic only from DialUP-IPSec to Internal LAN

From remote Fortigate i can't see traffic because source ip adddress was public ip of client.

[AEK]

Hi Marco

Glad to see that you fixed it. You can mark your last post as solution so it can help other members.