SSL VPN Can' t Access new Data Center Subnet

[Daniel_Herbon]

We' ve used SSLVPN on the Fortigate for nearly 3 years without any issues. The users connect and receive a 192.168.10.[10-254] ip address. Our issue came into play when we moved all our servers out of our main office and into our new data center. Despite our best efforts, we still cannot seem to get the users connecting to be able to route to our 10.1.0.0/16 network. We think we finally tracked it down to the DHCP addresses its handing out to the connecting users. When I connect I receive 192.168.10.10/255.255.255.255 as the address which is where I think the limitation is coming from. The users can connect to every single one of our 192.168.*.* networks but it cannot route to the 10.1.0.0/16 network. Any ideas? One of my admins thinks maybe the 255.255.255.255 netmask handed out via DHCP is limiting the connections ability to access networks outside the 192.168.*.* network. I' m skeptical. We have a Static Route setup to point all 192.168.10.0/24 traffic to device ssl.root. I was thinking maybe a policy route might help us? Thanks ahead of time for any suggestions. Maybe we' re just overlooking something extremely obvious.

[rwpatterson]

Is the data center local to the SSL VPN router, or remote down another leg?

[Carl_Wallmark]

Are you pushing out the 10.1.0.0/16 network to your SSLVPN users ? if not, you add the network to the firewall policy that looks like this: Policy Type: SSLVPN Source Interface: WAN1 Source Address: all Destination Interface: Internal Destination address: <all networks you wish to push to the clients>

[Daniel_Herbon]

This turned out to be a bad tunnel policy going to the DC! Spent too much time looking elsewhere rather than step 1.