Moving SSL VPN DHCP to external Microsoft Server

[julianhaines]

Good day,

I am trying to move away from using the FortiGate for DHCP for SSL VPN to using an external Microsoft server but need some advice on doing this. 

My current internal network uses 10.0.0.0/21 for DHCP and currently the FortiGate uses an address list to allocate IPs to the SSL VPN from 10.0.3.0/21 which is within the 10.0.0.0/21 subnet.

I recently tried to implement external DHCP using the random subnet 10.1.10.0/24 which I setup on the external DHCP server and when I connected to the SSL VPN, I got an IP from the SSL VPN server but could not route to the 10.0.0./21 subnet.

Did I use the wrong subnet? I investigated the 10.0.0.0/21 subnet, and it looks like 10.0.16.0/21 may be what I should have used but not sure, when moving to an external DHCP are there any routes I need to setup or does the FortiGate handle this? Maybe I need a static route from 10.0.16.0/21 to 10.0.0.0/21?

Thanks in advance I am just learning about subnets and routing.

Julian

[saleha]

Hi Julian,

Thank you for reaching out. Based on what you mrnyiornf hrtr I assume that your summary network for all dhcp servers is 10.0.0.0/21 and the subnet you allocated for sslvpn was changed from 10.0.3.0 to 10.1.10.0/24 instead. Such a change must be followed with reviewing the firewall policies for sslvpn to make sure the sslvpn addresses are updated. I don't think there should be a routing issue since you change the sslvpn subnet not the destination it is supposed to reach however one way to check is to execute the commands below:
# get router info routing-table all

# get router info routing-table details x.x.x.x ------ replace with the subnet or ip address from the subnet you want to check route for

To troubleshoot traffic issue you can run a sniffer to check where the traffic stops and debug flow to findout if the packets are dropped or being denied for specific reason:

# diag sniffer packet any "host x.x.x.x" 4 0 l ----- stop it with ctrl+c

# di de flow filter addr x.x.x.x

# diag de flow show function enable

# diag de flow trace start 10

# diag de console time enable

# diag de enable

Ref article for troubleshooting steps: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-First-steps-to-troubleshoot-connecti...

Thank you,

saleha