Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
MadDog_2023
New Contributor III

How to advertise a site-to-site VPN subnet to SSL VPN connections

Hi All,

The is an IPSec tunnel between a branch office and a head office. 

In the branch office there is a subnet 192.168.166.0/24

 

SSL VPN (10.212.134.0/24) - HO-FG - IPSec VPN Tunnel - BO (192.168.166.0/24)

 

192168.166.0/24 route with interface BO-TUNNEL is added as a static route

Subnet 10.212.134.0/24 - 192.168.166.0/24 is added in the VPN phase 2 settings. 

 

At the moment the issue is that when SSL VPN users connect to the HO the subnet 192.168.166.0/24 is not advertised so as a result SSL VPN users cannot access 192.168.166.0/24 subnet in the branch office.

 

Could you please help to advertise 192.168.166.0/24 subnet to SSL VPN connections.

7 REPLIES 7
pjawalekar
Staff
Staff

Hi MadDog_2023,
I understood that you want to advertise ipsec vpn subnet 192.168.166.0/24 to SSLVPN user, you can do the same under the SSLVPN portal which you are using for the SSLVPN users. If you are using split tunneling under the tunnel mode you can add ipsec vpn subnet 192.168.166.0/24 into the routing address field. 

You have to configure the SSL VPN policies accordingly (add subnet 192.168.166.0/24 in sslvpn policy) . Also the SSLVPN subnet should be part of phase2 selector in ipsec vpn configuration and policies should allow the traffic.

 

Below is the article for Split tunnel with SSL VPN:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Enabling-split-tunnel-feature-for-SSL-VPN/...

SSL VPN to IPsec VPN
https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/45836/ssl-vpn-to-ipsec-vpn#:~:text=Go%2....
 

Regard's,

Pratik

 

MadDog_2023
New Contributor III

Hi @pjawalekar,

Thanks for your reply.

I will have a look on the articles you provided.

Interestingly, when under Policy & Objects - Addresses I changed 192.168.166.0/24 to a more specific 192.168.166.10/32 address it started to be advertised. 

Is it normal behavior for FortiGate?

 

 

 

Keerthi_A

Hi @MadDog_2023,

 

Ideally, Irrespective of specific IP or a subnet or supernet, if the object is added to the split-tunnel in the respective ssl-vpn portal mapped to the user, the same will be injected in the routing table towards ssl-vpn vnic when the user connects to ssl-vpn.

 

However, if you add any new IP/Subnet to split tunnel, the user must reconnect to SSL-VPN for the new routes to be injected.

 

 

- Have you found a solution? Then give your helper a "Kudos" and mark the solution

Rassumkhan
New Contributor

Hey,

 

Have you configured the routing tables appropriately?

Proper routing configuration is crucial for directing traffic to the desired subnets. Have you added the necessary routes to ensure that traffic bound for the site-to-site VPN subnet is correctly routed through the SSL VPN connection?

MadDog_2023

Yes, a static route was added.

It works for IPSec site-to-site tunnel but did not for SSL VPN until I changed 192.168.166.0/24 to a more specific 192.168.166.10/32.

Toshi_Esumi
Esteemed Contributor III

What routes are in your client device routing-table? For Windows "route -print" for Mac "netstat -nr".

Do you see 192.168.166.10/32 there? As @pjawalekar and @Keerthi_A explained, a common way to specify the subnets to be inserted (not advertised) in split-tunnel is to specify them in SSL VPN portals.

But you sounded like you didn't do that way but specified only at the ssl.root->BO-TUNNEL policy, which is referring to the "address" object you changed.

But I feel something is off. That's why I'd like to see what exactly in the client's table.

 

Toshi

mle2802
Staff
Staff

Hi @MadDog_2023,

When you add the whole subnet not the /32, what is the local routing table on client machine? Did you see the subnet via SSL VPN?

Regards,
Minh

Top Kudoed Authors