Netmask preventing SSL VPN tunnel from working?

[Jon_Fleming]

Fortigate 50B 3.00-b0726(MR7). Since there are sometimes issues with my IPSec VPN, I thought I' d try out an SSL VPN. I set it up per the documentation: a user group that is authenticated by my LDAP server, an " SSL Internal network" address of 192.168.0.0/255.255.255.0, a tunnel IP range of 192.168.0.8-192.168.0.49 which is outside my DHCP server' s range, and a firewall policy from WAN1/any to internal/" SSL Internal network" always/any/SSL VPN and the LDAP user group allowed. I can connect using IE7 as advertised and activate the tunnel and get an IP and DNS server and WINS server and whatnot EXCEPT ... The fortissl adapter gets a subnet mask of 255.255.255.255. So even though I have a 192.168.0.8 IP I can' t connect to anything on the internal network. If I try " Test for Reachability (ping)" in IE to 192.168.0.250, a popup advises me that it' s reachable. If I ping 192.168.0.250 at the command line, I get four timeouts. What have I missed?

[UkWizard]

I think the 255.255.255.255 netmask is normal for this, so i think the problem is elsewhere. could be misconfigured of the local firewall is preventing the traffic. Also be careful that the client machine isnt on a 192.168.0.x network, else you will get routing issues as well.... thats the most common private subnet range unfortunately.

[rwpatterson]

Did you create the reverse static routes to 192.168.0.[8-49] back to ssl.root? This is needed after MR5.

[Jon_Fleming]

No, I didn' t create the reverse static route, and I haven' t the slightest idea how to do so. It' s not mentioned in FortiGate_SSL_VPN_User_Guide_01-30007-0348-20080718.pdf or Basic SSL Setup.pdf. (FWIW the client is on a 192.168.16.x or 192.168.1.x network, depending on where I' m testing from).

[rwpatterson]

Traffic flows like this (works for me!)

Internet -> ssl.root (user IP in the FGT should now be 192.168.0.[8-49])

ssl.root -> internal/dmz/portx (wherever) The Fortigate needs to know that the tunnel IP addresses are not going out the default path, so

Static route 192.168.0.[8-49] -> ssl.root The FGT knows which end user to get to after that. ssl.root is simply another interface. Hope that helps

[Jon_Fleming]

Well, I get the general idea, but in the Router/Static/Create New dialog I can' t get it to accept 192.168.0.[8-49] or 192.168.0.[8-49]/255.255.255.0 or any variation of that I can think of. I know that somewhere in the documentation there' s an explanation of how to specify IP addresses or ranges, but I can' t locate it.

[Jon_Fleming]

OK, so here' s what I have to date: [ul]

If one carefully follows, step-by-step, the instructions in Fortinet' s " Basic SSL Setup.pdf" , taking great care to follow the instructions exactly, the result is a non-operational SSL VPN (at least in tunnel mode).

If one carefully follows, step-by-step, the different instructions in Fortient' s " FortiGate_SSL_VPN_User_Guide_01-30007-0348-20080718.pdf" , taking great care to follow the instructions exactly, the result is a non-operational SSL VPN (at least in tunnel mode).

It is not possible to create a static route that routes anything but 0.0.0.0/0.0.0.0 to ssl.root.

Nobody knows what is required or what steps to follow to get an SSL VPN working. [/ul] Does anyone actually have a working Fortigate SSL VPN? Has anyone actually ever figured out how to get anything working in a Fortigate router from just the printed documentation? Boy, was this the wrong router to buy. I only have two degrees from MIT, obviously I should have gone for another if I wanted to administer a Fortigate router.

[rwpatterson]

In router static, you can' t use ranges, only networks. (x.x.x.x/y) You would have to break a 16 node network into /255.255.255.240 for example. So to get the bottom 16 IPs routed, it would be 192.168.0.0/255.255.255.240. Without that routing statement, the SSL ain' t gonna happen. Optionally (which is a pain) is to put in the addresses individually, like what is done during an upgrade.... How far along in the process do you get? Note added later: I just realized I wrote that range in my prior post....my bad!!!

[FortiRack_Eric]

I' m seeing this post for the first time. First of all, it is clear that SSL VPN works. The network design you have is faulty. Basic rule: if your network range is 192.168.0.0/24 then any of your remote connections/networks are NOT. A SSL connection is a remote connection. So you define your SSL range like 172.19.1.0/24 then you can setup a routing to the ssl.root interface. Try it, and you' ll see. Cheers, Eric

[Jon_Fleming]

Without that routing statement, the SSL ain' t gonna happen

Interesting. I know that you don' t write Fortigate documentation, but are you aware that there is no mention of creating a route of any kind in any of the Fortigate documentation on setting up an SSL network?

How far along in the process do you get?

It' s hard to characterize.

Basic rule: if your network range is 192.168.0.0/24 then any of your remote connections/networks are NOT. A SSL connection is a remote connection. So you define your SSL range like 172.19.1.0/24 then you can setup a routing to the ssl.root interface.

OK, I see I made a mistake. If you read the documentation carefully it does say that. However, I have the Fortigate managing an IPSec VPN which assigns IP addresses in my internal network range, and it seems to me that IPSec is a remote connection. So, starting again using 192.168.32.1-192.168.32.255 as my tunnel IP range and 192.168.0.0/24 is my internal network range. Let' s dive into Basic SSL Setup.pdf. " Under Advanced, define any internal DNS or WINS servers present in your network, ..." . OK, 192.168.0.250 is my DNS and WINS server, so enter that twice. Set up a user and user group ... check. I have LDAP working for IPSec but for now I' m just trying to get this going with a locally defined user. Define a firewall policy. Set the Source Interface to the interface that connects your FortiGate unit to the Internet .. OK, Wan1. Set the Source Address to all. Set the Destination Interface to the interface connected to your internal network ... OK, internal. Set the Destination Address to all. Set the action to SSL-VPN. Select the user group that you just added in the list on the left and select the right arrow to add that user group to this policy. Select OK. " Error: Destination address of split tunneling policy is invalid" . OK, turn off split tunneling for that user group, although I' ll certainly need it to put this into production, I' m not going to feed all traffic from a user in Israel or India or the Ukraine through me. Off to another tab to test ... OK, I can log in, and I can initiate tunnel mode and get connected. According to the manual " Access at this point requires either that users know the IP addresses of internal servers, or that your DNS server is configured to resolve internal machine names, also called netbios names, of those servers." Well, my DNS server at 192.168.0.250 is configured to resolve NetBIOS names, but let' s go to http://192.168.0.250 in a new tab. Internet Explorer cannot display the webpage. Ipconfig /all yields: PPP adapter fortissl: Connection-specific DNS Suffix . : Description . . . . . . . . . . . : fortissl Physical Address. . . . . . . . . : DHCP Enabled. . . . . . . . . . . : No Autoconfiguration Enabled . . . . : Yes IPv4 Address. . . . . . . . . . . : 192.168.32.1(Preferred) Subnet Mask . . . . . . . . . . . : 255.255.255.255 Default Gateway . . . . . . . . . : 0.0.0.0 DNS Servers . . . . . . . . . . . : 192.168.0.250 Primary WINS Server . . . . . . . : 192.168.0.250 Secondary WINS Server . . . . . . : 192.168.0.250 NetBIOS over Tcpip. . . . . . . . : Enabled Back to the " Welcome to SSL-VPN Service" tab. Test for reachability 192.168.0.250 returns reachable. Connect to Web Server 192.168.0.250 opens a new window with Remote Web Workplace displayed and https://192.168.16.16:10443/proxy/http/192.168.0.250/ in the address bar. Click on My Company' s Internal Web Site: Internet Explorer cannot display the webpage. https://192.168.16.16:10443/proxy/http/companyweb in the address bar. Gosharootie, seems to me that this is pretty useless and not operating as advertised. This message is a tad long, so I' ll continue on the next rock ...