SSL VPN Tunnel Mode Problems

[hakenmt]

I have FortiWifi 60C set up running v5.0,build0252 (GA Patch 5). When I configure an SSL VPN rule for example: Source: WAN Destination: Internal Static route created for the ssl.root interface If I use the web based portal, I can ping and RDP to servers through the connection widget. However, if I connect through the tunnel mode widget, I can' t actually connect to anything on the internal network. If I change the destination to say, Internal2, and then create a policy like Source: ssl.root Destination: Internal Then when I use tunnel mode, everything works fine. Why does the first scenario not work for tunnel mode? The documentation for SSL VPNs would lead me to believe that it should work for both web and tunnel mode to be able to connect from the WAN to Internal.

[Istvan_Takacs_FTNT]

Which documentation are you referring to? The one that I read " FortiOSTM Handbook for FortiOS 5.0" clearly states that you need 2 policies for tunnel-mode SSL VPN access:

You will need at least one SSL VPN security policy. This is an identity-based policy that authenticates users and enables them to access the SSL VPN web portal. ...... If you will provide tunnel mode access, you will need a second security policy — an ACCEPT tunnel mode policy to permit traffic to flow between the SSL VPN tunnel and the protected networks.

[emnoc]

Because the SSL vpn pool range needs a fwpolicy to allow for traffic originating when in tunnel-mode. if you would do a; diag debug reset diag debug en diag debug flow addr <insert the 1st ip_address of your SSLVPN> diag debug show console enable diag debug trace start 1000 make sure the above filter matchs the address assigned to your virtual ssl interface And then connect with the sslvpn client, you would see this. The diag debug flow is truly your friend.

[hakenmt]

I was looking at the configuration examples in the documentation, but I missed that I guess they weren' t setting it up for tunnel mode, it was web only. But actually, my real problem was that I had two separate VPN policies with two different sources, but they both had the same destination interface. Apparently this doesn' t work with tunnel mode (even though I actually did have a firewall policy to allow tunnel mode from ssl.root to that interface). I removed the " extra" one I had in there and everything started working. I assume this is normal behavior?

[Istvan_Takacs_FTNT]

Not sure what you mean by " two different sources" . Usually what you create is a from ' any' to ' interface' for tunnel-mode VPN, than another one from ' ssl.vDOM' to ' LAN' to enable the access. If you restrict the first one to specific source, it might not work as the connecting IP can be different especially coming from a dynamic address. If in the second case you specify anything else than the ssl.vDOM interface as the source, than it' s a misconfiguration of the tunnel-mode VPN. If you include your initial configuration here, we could tell you if the behaviour was expected, or something was wrong with the config.