FortiClient VPN IPSEC to SDWAN

[it-andreagx]

Hello, 

I need to connect a #Fortigate with FortiOS 7.4.6 and SDWAN by FortiClient VPN (IPSEC

Is there a way to achieve this goal? 

This article is about Site to Site scenario, but about client to SDWAN? 
Configure IPsec VPN with SD-WAN - Fortinet Community

Thank you 

[AEK]

Hi Andrea

These two articles should help.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-IPsec-dial-up-full-tunnel-with-FortiClient...

https://community.fortinet.com/t5/FortiClient/Technical-Tip-How-to-configure-IPsec-VPN-Tunnel-using-...

SD-WAN will not change anything to the IPsec configuration. In IPsec config you have to select the physical interface, not the SD-WAN interface. So if you need to use both WAN interfaces then you will have to create two IPsec tunnels on your FG (one on each interface).

[it-andreagx]

Hello AEK, 

thank you for your reply, but really it doesn't seem that simple.
The classic configuration do not work with SDWAN.

[Theo4]

Which article are you referring to? and what exactly do you mean by "connect SDWAN by FortiClient VPN"?

[Dhruvin_patel]

Greetings,

You can connect a FortiGate with FortiOS 7.4.6 using FortiClient VPN (IPsec) and integrate it with SD-WAN.

Create the dialup tunnel, then add the IPsec Interface to the SD-WAN.

Note: Please make sure that no policy with an IPsec tunnel is created; otherwise, adding an IPsec interface as a member in SD-WAN will not be allowed.

Regards!

If you have found a solution, please like and accept it to make it easily accessible for others.

[it-andreagx]

Hello, 

the interface (WAN2) is part of SDWAN zone. 
So, we don't need any policies related to the tunnel associated with WAN2 and the SD-WAN zone?

[Dhruvin_patel]

I mean the policy associated with the IPsec tunnel's virtual interface.

There should not be any policy directly applied to the IPsec tunnel itself.

[it-andreagx]

At this point, I think something is not entirely clear to me :(

I’ll try to provide more details about the scenario and the issue:

1. This is the Dialup VPN (client to Fortigate), and it was working before the implementation of SD-WAN.

FG60E (test) # show
config vpn ipsec phase1-interface
edit "test"
set type dynamic
set interface "wan2"
set mode aggressive
set peertype any
set net-device disable
set mode-cfg enable
set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
set comments "VPN: test (creato da VPN wizard)"
set wizard-type dialup-forticlient
set xauthtype auto
set authusrgrp "VPN"
set ipv4-start-ip 192.168.50.1
set ipv4-end-ip 192.168.50.100
set dns-mode auto
set ipv4-split-include "test_split"
set save-password enable
set psksecret ENC ad0bNv/0orBzifHsTD4rOuf0r
next
end

-----------------

The related fw policy

FG60E # config firewall policy

FG60E (policy) # edit "10"

FG60E (10) # show
config firewall policy
edit 10
set name "vpn_test_remote_0"
set uuid 58e626b8-beeb-51ef-4616-54ea6336f9cc
set srcintf "test"
set dstintf "internal"
set action accept
set srcaddr "test_range"
set dstaddr "Company_network"
set schedule "always"
set service "ALL"
set nat enable
set comments "VPN: test (Created by VPN wizard)"
next
end

2. SD-WAN configuration 

FG60E # config system sdwan

FG60E (sdwan) # config service

FG60E- (service) # edit "1"

FG60E (1) # show
config service
edit 1
set name "SDWAN-RULE"
set mode priority
set dst "all"
set src "all"
set health-check "SDWAN_SLA"
set link-cost-factor outbandwidth
set priority-members 2 1
set priority-zone "SD-WAN-Zone"
next
end

Now, if I try to connect to the Fortigate using FortiClient, nothing happens, and no traffic is logged (even with debug enabled)

If I try to configure a VPN within the SD-WAN, only the Site-to-Site option is available

So, what do I need to do to make FortiClient and IPsec VPN work with SD-WAN?

TNX

[AEK]

Hi Andrea

If I understand well you are trying to create the tunnel from SD-WAN config view. This may be a feature on 7.4 that I don't know. I'm using old 7.0.16 with SD-WAN, and there is no such feature, but I still can create a tunnel with the IPsec wizard, and I can select any of the physical interfaces that are members of my SD-WAN.

So can you try with IPsec wizard instead?

[sw2090]

At least in FOS 7.2. there is some bug with ipsec dial up and sdwan. Sdwan cannot correctly detect wether a dialup is up or not and in interface mode the interface itself is always up. This leads to sdwan not taking down unusable routes which causes routing trouble then.

I don't know if that has been fixed in 7.4.