SSL VPN Users cannot access IPSEC tunnels.

[Atomizer]

I have a lot of IPSEC VPN tunnels that are sourcenatting (hiding) our network from the remote sites. This is working fine with no issues. But now I would like to add SSL VPN funtionality so that we can connect to our firewall and have access to both internal networks as well as IPSEC sites. Internal networks are working fine but I' m unable to create a VPN policy that allows traffic from SSL VPN Users group to IPSEC site while still sourcenatting (hiding) our subnet. EG. In this case hiding the SSL VPN Address pool from the remote IPSEC sites. When I create the policy and chose VPN no sourcenatting options are available. My number one wish was to use one single tunnel interface for the IPSEC tunnels so that I didn' t have to add seperate policies to internal and ssl vpn users. Can someone shed some light on this problem. Here' s the link to a thread with a drawing of my network before I started implemting SSL VPN: https://forum.fortinet.com/FindPost/104484 Any help is appreciated. Thanks in advance. /Martin

[rwpatterson]

How are the IPSec tunnels configured: Interface mode (preferred) or policy mode (older and less configurable)?

[Atomizer]

They are route based IPSEC VPN' s and have each their own tunnel interface as I haven' t yet found a way to create one tunnel interface and attaching multiple IPSEC VPNs to this one tunnel interface.

[rwpatterson]

ORIGINAL: Atomizer They are route based IPSEC VPN' s and have each their own tunnel interface as I haven' t yet found a way to create one tunnel interface and attaching multiple IPSEC VPNs to this one tunnel interface.

Since the IPSec tunnels are interfaces, put them into a zone.

[Atomizer]

No one?

[emnoc]

So are you allowing all traffic into the SSLVPN tunnel-mode clients? When you do a traceroute from the client or look at the route table do you see the destinations of the remote-ipsec tunnel networks? Also, just reading out loud, you will probably need to SNAT the SSLVPN pool into your policies for the IPSEC destinations. So I would start with the traceroute 1st, look at the policies allowing the SSLVPN clients and then if you think that' s good, diag debug flow is you friend. FWIW: SNAT might be a good option, since the remote devices don' t have to have routes to your SSLVPN ip-pool-addresses imho

[Atomizer]

Thanks for the reply.

So are you allowing all traffic into the SSLVPN tunnel-mode clients? When you do a traceroute from the client or look at the route table do you see the destinations of the remote-ipsec tunnel networks?

No, I' m using splittunnel only traffic for the private networks is going through the SSLVPN tunnel. The rest is going directly to the ISP router. All remote IPSEC networks are tunneled through the SSL-VPN.

Also, just reading out loud, you will probably need to SNAT the SSLVPN pool into your policies for the IPSEC destinations.

I agree but the problem is that it' s not possible to craft the policies to allow this. Or at least I' m too stupid to figure it out. :)

So I would start with the traceroute 1st, look at the policies allowing the SSLVPN clients and then if you think that' s good, diag debug flow is you friend.

Before this, I will need to create the nessesary policies.

FWIW: SNAT might be a good option, since the remote devices don' t have to have routes to your SSLVPN ip-pool-addresses imho

I' m already doing this and that is what is preventing me from creating the right policy. I' m SNAT' ing all traffic that goes into the IPSEC tunnels with a unused Public from our public address scope. This works fine for clients on the internal network. But my problem is that when I create the policy to allow SSL VPN users to a network behind a IPSEC tunnel this type of policy (Policy-Type SSL-VPN) cannot do SNAT and so will not hide the VPN pool we use for the SSL VPN users.

[Atomizer]

Since the IPSec tunnels are interfaces, put them into a zone.

But how? I haven' t found anywhere in the firewall where I can create zones myself. The firewall is a 60D.

[rwpatterson]

I don' t have any V5 devices, but I believe in the ' System' , ' Network' section, create a new interface, and the option for it to be a zone is in there.

[John58]

For me, I think there are different problems. First: In Interface-Mode you can not ping into a ipsec dialin connection (from Fortigate to client). I have had a call at fortigate it works under V4 but not in V5. They give up and don' t find a way to get this work. Second is the bad advanced function on fortigate client 5.x. In ssl mode you must define all destination network as a group in the policy (Wan -> Intern / SSL-VPN). On IPSec you need the VPN-Editor from the 4.x version to do that. And yes you can create a Zone. Inside the GUI ->System -> Network -> Interfaces ->> Create New -> drop down menu = show zone to me. I hope you understand my english. Jens