IPSec can not share internet.Help.

[itadori98]

I have 3 fortigate (firmware is 7.2.11), one is using public IP as IPSec HQ, two are hehind NAT as IPSec dialup client. I am not use default udp 500 port.

Both three units are created ipsec tunnel by wizard and share the internet to client, and then change ikev1 to ikev2. All tunnels are up, three unit can access each others. But the two clients can not access internet via HQ WAN.

Any body help？ Thank you very much.

[kaman]

Hi itadori98,

The issue likely stems from misconfigured firewall policies or routing issues.Ensure that policies allow traffic from the VPN tunnel to the internet and vice versa.

Verify that routing is correctly configured, particularly if split tunnelling is enabled.

Is traffic to your internal servers not working either or is it just internet access?
If its both maybe the ip pool is clashing with the users local network at home.

If everyone else is fine, then the FortiGate shouldn't be a problem (or the first thing to be checked).

Have you tried having the same user connect from a different machine? Or different user from the same machine?

Kindly have a look at this article to see if you are missing any configuration?
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Dialup-VPN-Configuration-Between-Two-Forti...

Regards,
Aman

[sjoshi]

Hi itadori98,

Appending to the notes shared by kaman,

There should not be split tunneling configure on the HUB.

Make sure you have policy from tunnel to the wan on the HUB with NAT enabled.

Share me below sniff

On spoke:-

diag sniff packet any 'host 1.1.1.1 and icmp' 4 0 l

On Hub:-

diag sniff packet any 'host 1.1.1.1 and icmp' 4 0 l

Ping 1.1.1.1 from the client PC behind the spoke

Note:- Make sure default route on the spoke is pointing towards the VPN tunnel and in phase2 quick mode selector should be 0.0.0.0/0

[Toshi_Esumi]

As @sjoshi mentioned, the very first thing you need to take care of when you want to let remote locations to use the center/HQ location's internet is the default route for the remote locations.
It has to go toward the tunnel, not to the local internet.

But if you simply set a default static route to the tunnel interface, it would just break the tunnel not to come up because no route to the peer public IP through the local internet.
So if the HQ has a static public IP, just add a /32 static route toward the wan interface on the remote side. Then you can use the static default route to the tunnel.
Or, if the HQ's public IP is a dynamic, you need to set up a DDNS at the HQ so that remote can use the FQDN for the same static route instead of the /32.

The rest is about phase2 selectors and policies to allow the traffic on both ends of the tunnel.

Toshi

[dingjerry_FTNT]

Hi @itadori98 ,

You need to make sure:

1) On HQ FGT, you do have firewall policies allowing traffic from two dialup VPN tunnels to the Internet.

2) You do have NAT enabled in those firewall policies.

If it is still not working, please run debug flow commands on the HQ FGT and test it with Ping 8.8.8.8 from the client.

https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/38044/using-the-debug-flow-t...

So possible debug flow commands look like as below:

diag debug flow show iprope enable

diag debug flow filter addr 8.8.8.8

diag debug flow filter proto 1

diag debug flow trace start 10

diag debug enable

Then run the Ping for testing.  Please DO NOT run continuous Ping.

[dingjerry_FTNT]

And if possible, @itadori98 , please provide all relevant configurations.  You can mask sensitive information.