IPsec/SSL VPN no connection to OSPF sites

[Raffael_Hotz]

Hi guys,

I have my main FGT which has area 0.0.0.0 and some other areas which are connected to other sites via OSPF.

When I am directly connected to a subnet which lies in area 0.0.0.0 I can access everything, also I see that every route is propagated nicely. Now as I use OSPF I do not have any routes to the sites nor do I have policies with IP-ranges - just the regarding OSPF-interface tunnel with destination all.

Now my problem is when I connect via IPsec or SSL I cant see anything. I read already that you should do a static route to blackhole/ssl.int with the right ip-range and then redistribute static... I then saw the subnet on my branch-sites, but couldnt access them nonetheless. The policy was sourceintf SSL/IPsec - destintf Site1/2/3/xxx. sourceip the right IPsec or SSL range and destination all... I had the right network in the OSPF-network list, I had them as passive,...

What is it I am missing?

Thanks

Raffa

[preetisingh]

Can you share ospf configuration. 

refer :

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Announcing-SSL-VPN-address-range-into-OSPF...

[mokocub1]

You would need to create a static route pointing to SSL VPN interface and then redistribute static in OSPF.

If you want to control what static routes are redistributed to OSPF, you can create a prefix list and a route map in CLI https://routerlogin.uno/ .

[DPadula]

Another option would be avoid using split-tunnel and have all traffic sent to the FGT via SSL VPN. Doing that you will guarantee that does not matter what is the destination subnet all traffic will be sent to FGT.  

This option will request less configuration and maintenance in comparison to the prefix list + route map as suggest previously. The down side of it is all traffic will be sent via SSL VPN tunnel, including traffic that should be going to Internet.