IPsec Client VPN

[selokoeb]

HI, I have setup a client to site vpn in my firewall. Now I have created different IPsec VPNs for different departments but they are using the same remote gateway. I want to control the environments that different departments need to access. The issue is that once I enable the different policies for the different groups, the forticlient cannot connect. But once I disable all the policies and enable only one policy, I am able to connect and access my network. What could be the issue?

[sw2090]

hm maybe if you enable those policies no one matches the vpn traffic? Without (matching) policy the vpn will not connect. IPSec Debug log on cli on your FGt will show you a corresponding error upon connecting in this case.

I control different vpns (S2S as well as C2S) by simply using the corresponding vpn interface as source interface and the corresponding vpn subnet as source address(es). Works fine here.

[selokoeb]

OK, thanks for your response. Now tell me, how would you go about configuring a C2S IPsec vpn for an organization and then separate each department so that they can access only the networks they have the right to access?

[sw2090]

 would do that per department. Each department has a C2S to HQ. So all ppl at a department can dial in using that C2S of their department. This will require using peer ids at the remote gw to have he FGT use the right tunnel. Then you could do mode config to distribute ip adresse to clients and then you could use that tunnel interface plus subnet for policies...

I here have C2S to our HQ for Homeoffice, for the it dept and some more and they are done that way and it works fine.