IPSec VPN to isolated VLAN, then use policy to allow access to other VLANS

[kstotz]

I am using IPSec to establish a VPN tunnel to the Fortigate. This works and I am able to ping multiple VLANs on our network. 

What I would like to do is have the VPN clients landing into VLAN_VPN, from that VLAN I want to use Firewall policy to allow the VPN Clients to other VLANS.

I am able to do this, but the traffic always flow from VPN Interface to the other VLANs directly without forcing them through the VLAN_VPN. 

The Fortigate sees the other VLANs as directly connected, so the fortigate just sends the traffic directly from the VPN interface to the other VLANs.

Any suggestions on how to accomplish forcing the traffic to the isolated VLAN_VPN and then using policy to allow traffic to the other VLANs

Thanks

Kevi n

Thanks

Kevin

[funkylicious · Accepted solution]

the way you would want it to work would not be possible.

traffic from IPsec VPN will have the source the interface itself and to be honest, i dont see the point of that "isolated" vlan, since you are able to restrict traffic in the exact same way via firewall rules.

[kstotz]

Just to be sure I typed this correctly.

I agree with you that the traffic will always come from VPN source, but could't I NAT the vpn interface onto the VLAN_VPN and then route the traffic through the VLAN_VPN via IP Address rules and Interface rules?

Deny the traffic from VPN Interface to VLAN_X and allow traffic from VPN Interface to VLAN_VPN and the allow the VLAN_VPN traffic to VLAN_X?

I have worked on this awhile, chatgpt seems to think it's possible, but I am having my doubts.

[funkylicious]

is as you said: directly connected interfaces/subnets take priority over static or dynamic routes.

can you share why you would want to use this VLAN_VPN as the source ? if you require NAT for the ipsec traffic just enable NAT.

if you are keen on using a setup/config with traffic IPsec > VLAN_VPN > VLAN_X , then i would suggest looking into vrf which might get the result you want but it will require some additional configurations and maybe devices that do L3 routing.

[kstotz]

Thank you for your assistance.

Yes, we did enable NAT.

The thought process was to send all VPN traffic to an isolated VLAN and from that VLAN_VPN, farm out the traffic with firewall policies. Thereby the accounting and control is put on that one VLAN_VPN verses the VPN Interface. 

True all the same can be accomplished from the VPN Interface. 

I guess we are trying to make a firewall a router.