192168.166.0/24 route with interface BO-TUNNEL is added as a static route
Subnet 10.212.134.0/24 - 192.168.166.0/24 is added in the VPN phase 2 settings.
At the moment the issue is that when SSL VPN users connect to the HO the subnet 192.168.166.0/24 is not advertised so as a result SSL VPN users cannot access 192.168.166.0/24 subnet in the branch office.
Could you please help to advertise 192.168.166.0/24 subnet to SSL VPN connections.
Hi MadDog_2023, I understood that you want to advertise ipsec vpn subnet 192.168.166.0/24 to SSLVPN user, you can do the same under the SSLVPN portal which you are using for the SSLVPN users. If you are using split tunneling under the tunnel mode you can add ipsec vpn subnet 192.168.166.0/24 into the routing address field.
You have to configure the SSL VPN policies accordingly (add subnet 192.168.166.0/24 in sslvpn policy) . Also the SSLVPN subnet should be part of phase2 selector in ipsec vpn configuration and policies should allow the traffic.
Below is the article for Split tunnel with SSL VPN:
Ideally, Irrespective of specific IP or a subnet or supernet, if the object is added to the split-tunnel in the respective ssl-vpn portal mapped to the user, the same will be injected in the routing table towards ssl-vpn vnic when the user connects to ssl-vpn.
However, if you add any new IP/Subnet to split tunnel, the user must reconnect to SSL-VPN for the new routes to be injected.
- Have you found a solution? Then give your helper a "Kudos" and mark the solution
Have you configured the routing tables appropriately?
Proper routing configuration is crucial for directing traffic to the desired subnets. Have you added the necessary routes to ensure that traffic bound for the site-to-site VPN subnet is correctly routed through the SSL VPN connection?
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.