We use a website that authenticates user access based on our office public IP address. I have a vpn user that needs access to this website. How can I force access to this site for vpn users to reflect our public IP rather than their home IP? We would like to keep using split tunnel for all other internet access.
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
OK.... so have you checked other stuff? Do you have a policy allowing that traffic? Have you verified that traffic is in fact going across the tunnel? Have you done debug flow? Traceroute? Anything to help us help you further?
Hi dbelflower,
For this specific website, you can add its public IP to the list of addresses in split tunneling.
This way traffic would be routed to FGT via vpn tunnel and then you can allow the access towards internet for this traffic. Flow would look something like this:
Client -> VPN tunnel -> FGT --> internet -> website
This way traffic from client would use public IP of FGT.
Hope this helps.
Regards,
Shahan Agha
Unfortunately I can't access the website using its public IP from our office. It redirects to another page.
You would still add the public IP to the split tunnel list. When the remote user tries to access the page using domain name it will resolve to public IP and route over the VPN to your FGT and out your office public IP as source. However, the server will see that the client is using domain name and will present the correct web page.
https://www.educba.com/virtual-host/
Okay, thanks. I added the IP address to the "Accessible Networks" for my tunnel and now it just times out when trying to access the site.
OK.... so have you checked other stuff? Do you have a policy allowing that traffic? Have you verified that traffic is in fact going across the tunnel? Have you done debug flow? Traceroute? Anything to help us help you further?
Hi @dbelflower ,
The debug flow would help to understand the traffic flow.
diagnose debug reset
diagnose debug flow filter addr <source_IP> <dest_IP> and
diagnose debug console timestamp enable
diagnose debug flow show iprope enable
diagnose debug flow show function-name enable
diagnose debug flow trace start 1000
diagnose debug enable
After performing the test, you can stop debugging;
diagnose debug disable
diagnose debug reset
Thanks for the help. Once I fixed an issue with a firewall policy it worked!
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1712 | |
1093 | |
752 | |
447 | |
231 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.