New Senario IN IP SEC VPN Remote Client

[harmesh_88]

 We have an requirement from one Client that scenario mentioned below

We have firewall located in Country A and  we have one system in country B which have local ISP Internet .

Fortigate configured with IP Sec VPN Contry A and Forticlient installed in Country B System

when we connected  VPN  internet and LAN of Country A must coming from country A and also that PC also communicate with LAN segment Which is IN Country B.

 

We have configured IP Sec VPN with Split Tunnel we achieved 90 % this requirement internet working from Contry A and LAN also Accessible of Country A but after connection successfully established we are not able to Communicate with local lan of country B 

Kindly give solution for fulfill this requirement so i can able to access internet of  Country A and also can connect with our local lan

[emnoc]

Will obviously this will not work. You have the 192.168.1.0/24 overlapped for both country A/B LANs. This is why you should never used the defactor can 192.168.1.0/24 in a serious network.

If you look at the local host route table  for 192.168.1.0 255.255.255.0 I bet it's point out of the   ppp0 interface  or whatever your virtual adapter is labeled as. Can you confirm if this is the case?

[harmesh_88]

Sorry I uploaded wrong image lan ip is not same its different i updated with new jpg

[AndreaSoliva]

Hi

if both networks have no overlapping networks I would check following:

- What IP does the FortiClient receive from FortiGate after authentication (ipconfig /all look at the FortiClient VPN Adapter)

- If the received IP from FortiGate does also not overlapp with your networks on both site check routing (FortiClient must be activated and authentication has to be done) which means: What is the routing the FortiClient receives (route print all). You must have on the VPN Adapter of the FortiClient either 0.0.0.0 which means route all traffic though tunnel or a specific IP Range which represents the LAN segment to be reached by FortiClient.

- If you do not have "any" route on the FortiClient did you install the FortiClient with Admin rights? If no deinstall and install new. The Admin rights are neccessary that the route entry can be don.

hope this helps

have fun

Andrea

[emnoc]

All good points from Andrea ( as usual  )  and I would add a local packet sniffer on the "local lan users" to see what's happening at layer2+3 & where your packets are going out of if any. But I bet you have a local route issue.

Also make sure the network doesn't collide with any virtual-adapter like that in  vmware player/workstation, etc.... or other vpn adapters.