How to advertise a site-to-site VPN subnet to SSL VPN connections

[MadDog_2023]

Hi All,

The is an IPSec tunnel between a branch office and a head office. 

In the branch office there is a subnet 192.168.166.0/24

SSL VPN (10.212.134.0/24) - HO-FG - IPSec VPN Tunnel - BO (192.168.166.0/24)

192168.166.0/24 route with interface BO-TUNNEL is added as a static route

Subnet 10.212.134.0/24 - 192.168.166.0/24 is added in the VPN phase 2 settings. 

At the moment the issue is that when SSL VPN users connect to the HO the subnet 192.168.166.0/24 is not advertised so as a result SSL VPN users cannot access 192.168.166.0/24 subnet in the branch office.

Could you please help to advertise 192.168.166.0/24 subnet to SSL VPN connections.

[pjawalekar]

Hi MadDog_2023,
I understood that you want to advertise ipsec vpn subnet 192.168.166.0/24 to SSLVPN user, you can do the same under the SSLVPN portal which you are using for the SSLVPN users. If you are using split tunneling under the tunnel mode you can add ipsec vpn subnet 192.168.166.0/24 into the routing address field. 

You have to configure the SSL VPN policies accordingly (add subnet 192.168.166.0/24 in sslvpn policy) . Also the SSLVPN subnet should be part of phase2 selector in ipsec vpn configuration and policies should allow the traffic.

Below is the article for Split tunnel with SSL VPN:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Enabling-split-tunnel-feature-for-SSL-VPN/...

SSL VPN to IPsec VPN
https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/45836/ssl-vpn-to-ipsec-vpn#:~:text=Go%2....
 

Regard's,

Pratik

[MadDog_2023]

Hi @pjawalekar,

Thanks for your reply.

I will have a look on the articles you provided.

Interestingly, when under Policy & Objects - Addresses I changed 192.168.166.0/24 to a more specific 192.168.166.10/32 address it started to be advertised. 

Is it normal behavior for FortiGate?

[Keerthi_A]

Hi @MadDog_2023,

Ideally, Irrespective of specific IP or a subnet or supernet, if the object is added to the split-tunnel in the respective ssl-vpn portal mapped to the user, the same will be injected in the routing table towards ssl-vpn vnic when the user connects to ssl-vpn.

However, if you add any new IP/Subnet to split tunnel, the user must reconnect to SSL-VPN for the new routes to be injected.

- Have you found a solution? Then give your helper a "Kudos" and mark the solution

[Rassumkhan]

Hey,

Have you configured the routing tables appropriately?

Proper routing configuration is crucial for directing traffic to the desired subnets. Have you added the necessary routes to ensure that traffic bound for the site-to-site VPN subnet is correctly routed through the SSL VPN connection?

[MadDog_2023]

Yes, a static route was added.

It works for IPSec site-to-site tunnel but did not for SSL VPN until I changed 192.168.166.0/24 to a more specific 192.168.166.10/32.

[Toshi_Esumi]

What routes are in your client device routing-table? For Windows "route -print" for Mac "netstat -nr".

Do you see 192.168.166.10/32 there? As @pjawalekar and @Keerthi_A explained, a common way to specify the subnets to be inserted (not advertised) in split-tunnel is to specify them in SSL VPN portals.

But you sounded like you didn't do that way but specified only at the ssl.root->BO-TUNNEL policy, which is referring to the "address" object you changed.

But I feel something is off. That's why I'd like to see what exactly in the client's table.

Toshi

[mle2802]

Hi @MadDog_2023,

When you add the whole subnet not the /32, what is the local routing table on client machine? Did you see the subnet via SSL VPN?

Regards,
Minh