SSL VPN access to multiple subnets

[Christer]

Is there anyone who can explain how to configure my following case: Site A (headquarter) have a FGT60B (192.168.10.0/24) and site B have a FGT50A (192.168.3.0/24). We also have site C,D,E and F with same config. There is static site-to-site tunnels between Site A and all of the other sites. Site A have SSL/VPN configured. For a better control i want all remoteusers to access Site A instead of connect to " their own" FGT,s. All the sites can connect and work with servers in site A without any problem. Now, remoteusers need to access site B also. I have tried a couple of days with this config, but no success. All firmwares is MR6. What i can understand in MR6 there must be rules from ssl.root to something. Do i need to use concentrators as well? Thanks in advance //Christer

[rwpatterson]

If I understand this correctly, you wish all remote users to connect to site A via SSL VPN, then cruise through the IPSec tunnels to the other remote sites. If that is the case, then you need to make policies from ssl.root/IP address of remote user to site (C or D or E or F)/site subnet. This is easy if you defined the IPSec tunnels in interface mode. I would just make a zone of all these interfaces and make a single policy to this zone. If the SSL access already works, and the IPSec routing is already in place and working, this should be all you need to do. If you are using policy based IPSec tunnels it gets a bit more crazy.

[Christer]

I,m using policy based VPN for all tunnels. Maybe the only way is to use concentrators anyway? /Christer

[rwpatterson]

Have you tried making an accept policy from ssl.root to the subnet address group? Also have you ensured that there is a static route from the SSL VPN IP address back to ssl.root? That' s no longer done automatically and must be done manually in MR6. Look in your static routes. The SSL VPN IP addresses in place before the conversion will be there as a guide.

[Christer]

Thanks Bob. I have tried accept policy from ssl.root to the subnet and i,ve also checked the routes back to ssl.root. I think i will check if i can change the IPSec-tunnels from policy to interface mode. It looks easier to configure SSL VPN-access to multiple subnets that way. //Christer

[rwpatterson]

That was my next suggestion. (It works that way for me.) Good luck.

[#7]

I am also trying to accomplish the same thing. Would there be any difference in configuration for MR5 instead of MR6? Scott

[rwpatterson]

The major difference for SSL VPN between MR5 and MR6 is that they introduced a new interface in MR6, so you have to build a route back to it. In MR5, that was handled automatically. Also, you can no longer go straight in from the outside to the inside. The traffic has to stop first at the ssl.root interface before leaving to it' s final destination.