SSL VPN access only VLAN hosts directly connected to Fortigate

[cmohring]

Hi there!

We are installing a new Fortigate 60F. It will be quite a basic configuration, we have 3 VLAN defined in a VLAN switch attached to a L2 switch port in trunk/tagged mode and have created several policy rules to allow traffic between them (working fine). We also have users connecting through SSL VPN (planning for IPsec in the near future), and also created the respective rules to allow traffic from the VPN network segments to the different VLANs.

We are not 100% sure if Fortigate is working as expected or we are missing some rule, since users connecting through SSL VPN can see/access only hosts directly connected to the Fortigate (fortigate as GW) and not all hosts in the VLAN.

Would appreciate if someone could shed some light on this.

Thanks in advance.

BR

[Elmir]

For me, it seems you are missing some firewall rules. If possible, could you upload related config? Maybe I could help you.

[cmohring]

Hi @Elmir, thanks for your response:

Interface definition:

    edit "ssl.root"
        set vdom "root"
        set allowaccess ping
        set type tunnel
        set alias "SSL VPN interface"
        set role lan
        set snmp-index 7
    next
    edit "LAN"
        set vdom "root"
        set allowaccess ping https ssh
        set type hard-switch
        set device-identification enable
        set role lan
        set snmp-index 9
        set ip-managed-by-fortiipam disable
    next
    edit "VLAN Sup"
        set vdom "root"
        set ip 192.168.200.254 255.255.255.0
        set allowaccess ping https ssh http
        set device-identification enable
        set role lan
        set snmp-index 17
        set ip-managed-by-fortiipam disable
        set interface "LAN"
        set vlanid 200
    next
    edit "VLAN Est"
        set vdom "root"
        set ip 10.1.1.254 255.0.0.0
        set allowaccess ping https ssh http
        set device-identification enable
        set role lan
        set snmp-index 18
        set ip-managed-by-fortiipam disable
        set interface "LAN"
        set vlanid 1
    next
    edit "VLAN Dev"
        set vdom "root"
        set ip 192.168.220.254 255.255.255.0
        set allowaccess ping
        set device-identification enable
        set role lan
        set snmp-index 8
        set ip-managed-by-fortiipam disable
        set interface "LAN"
        set vlanid 220
    next

Address definition:

    edit "VPN Est Network"
        set subnet 172.120.0.0 255.255.255.0
    next
    next
    edit "VLAN Est"
        set subnet 10.1.1.0 255.0.0.0
    next

Policy rule:

    edit 3
        set name "SSLVPN Est"
        set srcintf "ssl.root"
        set dstintf "VLAN Est"
        set action accept
        set srcaddr "VPN Est Network"
        set dstaddr "VLAN Est"
        set schedule "always"
        set service "ALL"
        set groups "Est"
    next

Routing table:

get router info routing-table all
Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP
O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
V - BGP VPNv4
* - candidate default

Routing table for VRF=0
S* 0.0.0.0/0 [10/0] via 192.168.100.1, wan2, [1/0]
C 10.1.1.0/8 is directly connected, VLAN Est
C 192.168.100.0/24 is directly connected, wan2
C 192.168.200.0/24 is directly connected, VLAN Sup
C 192.168.220.0/24 is directly connected, VLAN Dev

Hope this helps.

[hbac]

Hi @cmohring, 

Your firewall policy "SSLVPN Est" only allows traffic to one VLAN. If you want to allow more VLANs you need to add those VLANs to the policy or create new policies. 

Regards, 

[cmohring]

Hi @hbac. Thanks for your response.

Yes, we have all other policies defined. I just posted one example, but all of them are on the same situation regarding the visibility to other hosts in their own VLAN.

BR

[cmohring]

Hi again.

We found out that when we configure the policy rule with NAT enabled, we can see al devices in the VLAN Est (not only those connected directly to FG). Same applies to other VLANs.

Surprisingly, with NAT enabled we lost communication to our Exchange server (VLAN Est, not connected to FG). So somehow this rule from ssl.root to VLAN Est is affecting traffic to WAN interface.

Will keep you posted if we find out something else.

[Pittstate]

Go to Network > Diagnostics > Debug Flow and use that to trace the packet flow through the FG. You'll probably want to use Advanced to control the amount of traffic captured by setting the source/destination IP addresses. This should give you an idea of where things are failing.

[cmohring]

Hi @Pittstate.

I checked the Debug Flow, but I only get sent packets matching a policy:

24/06/2024 9:55	vd-root:0 received a packet(proto=1, 172.120.0.1:1->10.1.1.6:2048) tun_id=0.0.0.0 from ssl.root. type=8, code=0, id=1, seq=293.
24/06/2024 9:55	allocate a new session-000605d7
24/06/2024 9:55	in-[ssl.root], out-[]
24/06/2024 9:55	len=0
24/06/2024 9:55	result: skb_flags-02000000, vid-0, ret-no-match, act-accept, flag-00000000
24/06/2024 9:55	find a route: flag=04000000 gw-10.1.1.6 via VLAN Est
24/06/2024 9:55	in-[ssl.root], out-[VLAN Est], skb_flags-02000000, vid-0, app_id: 0, url_cat_id: 0
24/06/2024 9:55	gnum-100004, use int hash, slot=64, len=2
24/06/2024 9:55	checked gnum-100004 policy-3, ret-matched, act-accept
24/06/2024 9:55	ret-matched
24/06/2024 9:55	gnum-4e20, check-ffffffbffc02c594
24/06/2024 9:55	checked gnum-4e20 policy-6, ret-no-match, act-accept
24/06/2024 9:55	checked gnum-4e20 policy-6, ret-no-match, act-accept
24/06/2024 9:55	checked gnum-4e20 policy-6, ret-no-match, act-accept
24/06/2024 9:55	gnum-4e20 check result: ret-no-match, act-accept, flag-00000000, flag2-00000000
24/06/2024 9:55	policy-3 is matched, act-accept
24/06/2024 9:55	after iprope_captive_check(): is_captive-0, ret-matched, act-accept, idx-3
24/06/2024 9:55	after iprope_captive_check(): is_captive-0, ret-matched, act-accept, idx-3
24/06/2024 9:55	after iprope_captive_check(): is_captive-0, ret-matched, act-accept, idx-3
24/06/2024 9:55	after iprope_captive_check(): is_captive-0, ret-matched, act-accept, idx-3
24/06/2024 9:55	Allowed by Policy-3:

I'm afraid there is no logical return path.

[Pittstate]

Well, your "VPN Est" to "VLAN Est" rule seems to work and gets matched.

If you set source and dest addresses, you might not see the return traffic, depending on how those were entered.

I know you've probably double checked this but the reverse rule is entered and correct?

[cmohring]

Hi @Pittstate, thanks again for your response.

Yes, we have the reverse rules defined (not triggering though...)

In the previous trace, I don't really understand this messages:

checked gnum-4e20 policy-6, ret-no-match, act-accept

Policy 6 is disabled and is used for WAN to VLAN Est traffic.

I am afraid is not policy rule related, but more likely logical path/connectivity issue.

BR