How packets find their way back to a Users SSL VPN.

[systemgeek]

I am running FortiGate in AWS.  I have users who will be using SSL VPN (no natting).  

I have many hosts I need to reach over SSL-VPN in AWS that are accessed via a TransitGateway.  The TransitGateway has the route of 10.0.0.0/8.  However, when I am trying to access some of the servers the packets are not making it back to the FortiGate Firewall.

Does anyone know if I should create a route for the TransitGateway propagating the SSL-VPN pool IPs?

[AEK]

Hope this helps:

https://docs.aws.amazon.com/vpc/latest/tgw/tgw-route-tables.html

[systemgeek]

My question was not how to create the route tables.  That I know how to do.  The question is should I need to create it?

[AEK · Accepted solution]

First you need to find where the route is missing then add it at the right place (at Transit Gateway level or at clients level).

I guess your SSLVPN range is 10.x.x.x. You said Transit Gateway has the route of 10.0.0.0/8, but through which interface? Towards the interface connected to FortiGate or to the clients? in case to the clients then you probably need to add a route to SSLVPN subnet  through the interface connected FortiGate.

[systemgeek]

Let me see if I got it.  VIA tcpdump I can prove I am hitting the end points.  But I am not seeing the traffic make it back to the SSL VPN connection.  So what you are saying is I need a route on the Fortigate pointing the traffic from the endpoints back to the SSL-VPN (I am guessing ssl.root since thats the interface).

Does that sound about right?

[AEK]

No you don't need a route on FortiGate since SSL VPN client's packets are reaching the AWS hosts.

You may need route on clients or on Transit Gateway.

[systemgeek]

What I have is an AWS Organization which is composed of many accounts in AWS connected together.  Sadly, if you open a ticket with AWS support they are only able to look at the account the ticket was opened in.  My original ticket was opened in the account where the Transit Gateways exist.  But the FortiGates are in a different account.  Support asked me to open a ticket in the account where the FortiGates exist too so they could see both sides of the Transit Gateway.

Initially I created a route on the Transit Gateway telling it that the route for my VPN Clients could be found on Transit Gateway attachment XYZ.  So that took the packets to the correct VPC but then it was lost.  Support then had me add a route for the VPN Clients in the VPC pointing to the ENI of the Fortigate.

After creating this everything worked.