SSL VPN Routing

[John1849]

Hi, I have a Fortigate 200D firewall, it connect to internet. It also connect to a Juniper SSG 140 Firewall. The SSG 140 Firewall does not connect o internet, it use for internal network control. Basic Topology : Internet <--->200D<---> SSG 140<--->Server A SSL VPN IP Pool : 192.168.1.0/24 200D : 192.168.10.1/28 SSG 140 : 192.168.10.2/28 Server A : 172.16.100.20/24 I want use 200D SSL VPN to access server A (for example RDP) Questions: (1) if I use SSL VPN Web Mode, I will define a static Routes for network 172.16.100.0/24 (System\Router\Static Routes) and the next-hop is 192.168.10.2? Is it correct or not ? (2) If I use web mode, is it possible to create a policy based routing (I want to creat a routing when the source ip is from SSL VPN IP Pool) thanks John

[Istvan_Takacs_FTNT]

(1) You are correct, otherwise how else the Fortigate would know where to deliver packets heading to the 172 network? Unless you NAT it on the SSG and publish some 192.168.10.x/28 address instead to connect to Server A. (2) It is possible, but what would you use in the policy route?

[Istvan_Takacs_FTNT]

Just tested it and it' s working fine for me. One thing I missed previously is that I obviously had to add a static route on " Server A" that points back to 192.168.10.1 via the SSG internal 172.16.100.x interface as the SSL VPN web portal traffic is coming from the internal interface of the Fortigate, not from the assigned SSL VPN pool address. That' s only used for tunnel-mode access. Once I logged in to Fortigate via web portal, I was able to access my web server running on " Server A" Of course, the static route on the Fortigate to point at the SSG for the 172.x subnet is still required.