IPSEC client to site With Sdwan

[sojosselin]

Hello,

I have Fortinet Firewall 200E with SDWAN configured and I need to configure a VPN ipsec Client to site 

I create the tunnel, I added the policy I can connect but I cant reach the local subnet 

is there any think specific with sdwan 

just for information it works within SDWAN

thx for help

[Anthony_E]

Hello,

May I propose you to have a look in our Knowledge Base:

https://community.fortinet.com/t5/FortiGate/tkb-p/TKB20?pageNum=1

You will have a lot of articles with a lot of topics.

If you do not find the solution there, come back to us and we will find an answer to your question.

Regards,

[akristof · Accepted solution]

Hello,

Thank you for your question.
Just to clarify, you have problem to reach subnet over the Ipsec tunnel from FortiGate or from local lan (or vice-versa)? If you have problem to reach remove subnet from FortiGate and you are using SDWAN with sdwan rules, you might need to use this ping-option:
exec ping-options use-sdwan yes

[sojosselin]

i have Problem to reach the LAN from VPN 

I can connect on VPN ( client to site ) but i can't reach the site's LAN 

and i thnik its not a problem of ping because  the http don't pass to 

thank you 

[akristof]

Hi,

Thanks for reply. I am bit confused what exactly is the design. Can you please clarify? Is it like this:
Client < Ipsec VPN > FortiGate <  LAN >

or

Client < Ipsec VPN > FortiGate < Site to site tunnel > FortiGate <  LAN >

Can you provide some examples of IPs, what is client IP, which IP address you are trying to reach etc. You can use debug flow to at least verify, that the ping/http is being received by FortiGate:

https://docs.fortinet.com/document/fortigate/6.2.7/cookbook/54688/debugging-the-packet-flow

[sojosselin]

thank you 

its : Client < Ipsec VPN > FortiGate <  LAN > 

for the client i defined the rang 192.168.98.0/23

for the lan i want to reach 192.168.196.0/22

thx 

[akristof]

Hello,

Thanks for reply. In that case, I am not sure I understand why remote VPN is part of SDWAN, but ok. If the VPN is working without SDWAN (when it is standalone interface) I assume that the split-network is correct and the routing on client side is OK.

When VPN is part of the SDWAN, you will need firewall policy from SDWAN (or sdwan zone) to your LAN, with correct source/destination networks. If you have this, run the debug flow to see if traffic is received, if it is allowed and what exactly is FortiGate doing with traffic:

diag debug flow filter proto 6

diag debug flow filter port Y

diag debug flow filter addr X.X.X.X

diag debug flow show func en

diag debug flow trace start 25

diag debug enable

This debug will show you TCP traffic on port that you use. So you can use port 80/443 and then try to connect to it from VPN. And then you can paste it here and we can see if something is wrong.

Don't forget to disable debug:

diag debug reset

diag debug disable