How to Browse Internet while using FortiClient VPN Session

[Don_Draper]

First, I am VPN ignorant so if my questions appear trivial, then they probably are. If there was a poster child for the VPN iliterate...it would be me :). Using FortiClient 1.6.142 on XP Pro SP2 against a Fortigate 200A. Can anyone explain (in relatively simple terms) what is needed to browse the Web or other internet services while using VPN? My assumption was that while using FortiClient to connect to a Fortigate 200A, any browsing to the internet would actually be occuring throught the Fortigate. However, this does not appear to the case. While I have an active VPN session going to the Fortigate, I can browse other internet sites, check email etc. just fine. If I go to showmyip.com, it shows my public IP coming from my existing cable modem connection and not from the Fortigate network. So while I am connected to the Fortigate network just fine (can ping IPs, access servers) using VPN, I appear to have full internet access apparently using my local cable connection. Both networks, virtual and ethernet going to the local cable modem, appear in ipconfig/all. The FortiClient docs talk about having to add a 0.0.0.0/0.0.0.0 setting in advanced settings of the client connection in order to do internet browsing. When I add this, I can no longer browse the internet...so is there another setting on the fortigate that I need as well? I do have a policy that allows all outbound traffic (internal to wan1 for all services - the default one). The docs say that the Fortigate must be configured to allow internet access when using the 0.0.0.0/0.0.0.0. Can someone elude to what is required on the Fortigate if something else is needed other than this default outbound policy? This would not be an issue since I can VPN and surf EXCEPT another collegue is using the same FortiClient VPN profile, can VPN just fine... however all of his internet access is " disabled" while his VPN session is active! We run another app that also needs access to the internet so having access to both the VPN and the internet at the same time is required. Is there any document that explains this issue in detail? Any advice, suggetions would be greatly appreciated.

[#2]

Hi, there are roughly two options to browse the internet while having a VPN session. The first (standard) is just setup a VPN session and that will route only the data for the subnet through the VPN tunnel. In this case, you can access the Internet like having no VPN session. The second requires a bit more configuring, that all the traffic goes through the VPN tunnel and you have to config the remote side (Fortigate) that you will be allowed to access the internet through the tunnel. To achieve this you have to add 0.0.0.0/0.0.0.0 as an extra subnet in the FortiClient config and I guess that' s what' s missing, in the Fortigate in the Phase 2 part you have to enable Internet browsing. Sometimes the allow Internet browsing is omitted per se, so that Internet browsing is disabled at all, when a VPN session is live. hope this helps, regards, Eric

[Don_Draper]

Thanks Eric...this was the answer I needed. So standard VPN does allow both the VPN subnet and my separate local subnet to the Internet to both be active at the same time. Makes sense explains why it works for us by default. I had added the 0.0.0.0/0.0.0.0 subnet to the FortiClient but could not surf at all. However, as you suggested, I turned on " interner browsing" in Phase II Advanced for the Internal interface and only then was I able browse the internet through the VPN. Checking my IP at showmyip.com confirmed this. That was the part I was missing so thanks very much! Now I know how to make it work either way. We also discovered why my friend was unable to surf at all while he was connected to the VPN. Turns out his local home router was using 192.168.2.x, the same subnet as I had chosen for the virtual VPN subnet. Once he changed his router to use another subnet, he could surf while using the VPN as well. One more easy question please: There are three of us who could be using the VPN at the same time. I created VPL config files for the other two by incrementing the last value in the virtual IP by one and then saving. So each user' s config file might look like: User 1 - 192.168.2.2 User 2 - 192.168.2.3 User 3 - 192.168.2.4 However, I noticed that the virtual adapter created by FortiClient uses the next higher IP value for the the gateway and DHCP such as ipconfig /all shows: Description . . . . . . . . . . . : Fortinet virtual adapter - Fortidr Miniport Physical Address. . . . . . . . . : 00-09-0F-FE-00-01 Dhcp Enabled. . . . . . . . . . . : Yes Autoconfiguration Enabled . . . . : Yes IP Address. . . . . . . . . . . . : 192.168.2.2 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 192.168.2.3 <-- DHCP Server . . . . . . . . . . . : 192.168.2.3 <-- Would the 192.168.2.3 values prevent the other VPN user who is using 192.168.2.3 IP from being able to connect at the same time or do I just need to ignore this? In other words, do I need to create other virtual IPs for the users further apart so they do not conflict with the IP' s created by the virtual adapter? I admit we have not yet to tried to connect at the same time. Thanks again! Don

[#4]

Don' t worry that the IP' s seem to be overlapping. This sometimes happens (often with PPTP connections). This is not an issue, so the ip' s can be next to each other. Regards, Eric