Ping But No Access

[#1]

I can successfully negotiate a VPN Connection using FortiClient v 1.0.210 to a Fortigate 50A. I can ping addresses behind the FortiGate 50A, but I cannot access any services, pcAnywhere, VNC, Microsoft Remote Connection. Oh yea, I am usually behind another FortiGate firewall. If I connect directly to the Internet I can access aforementioned services. I am not in a situation where I can make a Box-to-Box connection. I have to use Client-to-Box. This works SOMETIME but not all the time!!! Any Ideas? Hal

[#2]

are the networks on either side of the fortigate' s the same ?

[vanc]

Ask support for a newer client build. the 210 build is buggy.

[UkWizard]

VPN' s dont like going through a NAT, so this may be causing the problem, if possible, try it outside of the firewall quickly to see if this is the cause. Also ensure the hosts behind the firewall have rules allowing them outbound. If routing is an issue, you can eliminate that easily by turning on the NAT for the vpn rule.

[#5]

are the networks on either side of the fortigate' s the same ? Client maching is a standalone laptop, not part in any way with either networks behind either firewall and neither network is related to the other. Ask support for a newer client build. the 210 build is buggy. I will check with support for a newer version of client. Do you know if I can upgrade and save my configurations? VPN' s dont like going through a NAT, so this may be causing the problem, if possible, try it outside of the firewall quickly to see if this is the cause. Also ensure the hosts behind the firewall have rules allowing them outbound. If routing is an issue, you can eliminate that easily by turning on the NAT for the vpn rule. I seems to work fine outside the firewall. I have setup a policy on the Host box that allows the VPN connection. Is there another policy that needs to be setup? Are you saying that I need to enable " inbound NAT" or " outbound NAT" or both on the Host firewall? Thank you all for your replys Hal

[vanc]

The client works fine with NAT as long as NAT-Traversal is enabled. You can safely upgrade to a new build and your configuration will be saved. If you upgrade to a new major version such as 1.2, you need to manually save your tunnel settings and uninstall the old client. Just launch regedit and go to HKLM\Software\Fortinet\FortiClient and save the IPSec tree to a file. After installed the new version, double click on the reg file and your old tunnel will be there after you start up the client GUI.

[UkWizard]

As it works okay outside of the firewall, this proves its the NAT thats breaking it (surprise surprise). Try Vanc' s siggestion of the nat-traversal option and see if it helps. If it doesnt, you will have to use PPTP instead or do a static mapping for each client (one internal pc gets assigned one static Nat VIP to a spare external IP).