[SOLVED] SSL vpn to remote network via ipsec

[kilrathi]

I' ve been working on this problem for a week now. I' ve spoke to Fortinet support and they comfirm my setup on the Fortigate is correct. Here' s what I have. Network 1 Subnet 10.1.3.0/24 SSL VPN Subnet 10.1.4.0/24 Network 2 Subnet 10.1.2.0/24 I want my users to be able to connect to Network 1 via ssl vpn. Once they are connect i want them to be able to use resources on Network 2. Network 1 & Network 2 are connected via a IPSec vpn connection. Users from Network 1 on subnet 10.1.3.0/24 can communicate with Network 2 just fine. Users from Network 1 on subnet 10.1.4.0/24 via SSL vpn cannot communicate with Network 2 at all. Network 1 is a Fortigate 60c Network 2 is a Cyberguard SG580 The SSL VPN connection is setup with tunnel mode enabled and split tunneling *disabled*. This means when my users connect all their network traffic (Intranet and Internet) are funneled through the SSL VPN connection. Inside the IPSec tunnel that connects the two networks together I have both 10.1.3.0 and 10.1.4.0 listed as an allowed subnet in the Phase 2 config. The routing table is identical as to the 10.1.3.0 and 10.1.4.0 networks respectively. When i run diag commands from Network 1 to trace the packets it shows the connection going to the remote network (Network 2) but I am not getting a response when using the 10.1.4.0 subnet. Originally i thought this was a routing issue, but the SG580 (Network 2) has the same config for 10.1.4.0/24 as 10.1.3.0/24. If neither of them worked I wouldn' t be as confused. Has anyone else ran into this type of issue when trying to connect to a remote network through your SSL VPN connection and a IPSec tunnel? I' m running a Fortigate 60c (Firmware 4.0 MR2) and a Cyberguard SG580 (Firmware 4.0.10) Any help or insight is appreciated.

[ede_pfau]

for future reference: If you want to have multiple subnets across an IPsec VPN then you can create an address group with multiple address objects in it, and put that into the QM selector as source or destination network. Here are the restrictions: 1. this usually works only from Fortigate to Fortigate 2. you have to switch the QM type to ' address' in the CLI 3. you have to use address groups for BOTH source and destination subnets even if one contains a single item only (the CLI does not enforce this requirement) Given these restrictions, it' s usually less hassle to create a bunch of phase 2' s if the number of subnets is small. I haven' t tried it but with an address you can specify an IP range as well as a subnet. You cannot do that directly in a QM, can you? So that would be another case for using the address group configuration.