Hi,
we're using a FortiGate 100E (v6.0.2 build0163 (GA)) with SSL VPN configured. Remote clients are assigned the entire 10.0.95.0/24 subnet while LAN 192.168.1.0/24 subnet.
No troubles for the remote subnet to access the internal LAN but cannot find a way to make internal LAN access SSL clients. I've tried to set a specific policy to enable traffic from LAN to SSL subnet but it seems to be ignored. Also, the route isn't correct because if I make a tracert from an internal LAN device pointing to a remote client it seems that the FortiGate sends the packet to the outside instead of redirecting them to the remote client through the tunnel interface. What I am missing?
Thank you
This is the policy that I tried:
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Bugs happen. It could be you are hitting one.
Without support you cannot talk to TAC nor can you run a supported FortiOS version. Right now you are exposing yourself to a lot of risk from a vulnerability, functionality and accessibility standpoint.
Please get support renewed on your Firewall and get it updated ASAP.
Try creating a static route for the 10.0.95.0/24 subnet to point to the SSL interface. The FGTs don't populate the routing table with the subnets you've created for the SSLVPN.
Hi @amouawad,
thank you for your reply.
Unfortunately, even with static route it doesn't work. Packets keep going outside instead of going to the right place. What else I can try to change/check?
Thank you
Are you sure its the Fortigate blocking? Perhaps there is a local Firewall on the endpoint?
Hi,
I've disabled every possible firewall anywhere including Windows firewall and remote router's firewall with no success. Strange thing is that even from CLI console I cannot ping and reach clients...
I tested myself w/o a static route configured on the FW ( 200E 6.4.9 ) to reach my machine connected in SSLVPN and works just fine from the FW and a device behind it.
Maybe it's time to upgrade the firmware, 6.0 is very old :)
Yes, maybe it's a firmware issue but as the support license expired unfortunately there's no way to test the connection with an updated firmware version... but despite OS version it should work anyway because everything is configured properly!
Bugs happen. It could be you are hitting one.
Without support you cannot talk to TAC nor can you run a supported FortiOS version. Right now you are exposing yourself to a lot of risk from a vulnerability, functionality and accessibility standpoint.
Please get support renewed on your Firewall and get it updated ASAP.
Yes, it could be a bug. Unfortunately, the person who sold us this firewall didn't tell us that it's a type of appliance that needs a subscription to receive basic firmware updates unlike other firewalls of different brands... as there's nothing to do without a subscription probably we'll consider moving to a different product. Thank you anyway for your support
Most enterprise-grade firewalls will require some form of subscription to access regular services like support and firmware upgrades.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1696 | |
1091 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.