SSL VPN into existing subnet

[ILC-Europe]

Is it possible to let fortigate hand out ip-adresses to ssl-vpn users from an existing subnet on the fortigate router where physical devices are also connected?

We have a customer that has an additional secure connection for health-related traffic. The third party router for that connection (i will name it 'secure router' from now on) has a /24 subnet (i will name it 'secure subnet' from now on) which is configured in the fortigate. We have routing policies in place to route the correct traffic to the secure router and the firewall policies is in place with SNAT actived so the secure router sees traffic from an IP of the ./24 subnet. Traffic is flowing without problems over the secure connection so the basics are all in place.

Clients use ssl-vpn to connect from various locaties. They get an ip-address from a pool that is created for these vpn users.

They use a prorgam that connects to a service behind that secure connection that uses the local IP of the client as identification. SNAT does not work as the application is sending it's local IP to the server. However the server can only be configured with ip's of the secure subnet, not the ssl-vpn subnet. So we would need to hand out ipadressen of the secure subnet directly to ssl-vpn user when connection.

I can give out the correct secure subnet IP-adresses to the vpn-client but then no traffic is flowing. I have some ideas why but that might just confuse things to note here. 

[AEK]

I don't think this will work (same subnet on both VPN and other interface) since you will at least have a routing conflict.

You said the application sends local client IP to the server. Do you mean it sends tunnel interface IP or local IP of physical interface?

If it sends the tunnel IP then you can make it work by removing NAT and configure route back to VPN in your secure network.

But if the app sends the local client IP of physical interface then I don't think you can find a solution for that except if you can change this behaviour.

[ILC-Europe]

Hello AEK,

thanks for your reply. I'm not sure how the matching works. Normally we have physical clients in a subnet, that subnet is known at the health service provider and particular IP's of that subnet are linked to logins/settings.

We tried to use SNAT from "unknown" vpn subnet to "known" subnet (lan side of secure router) so the application provider should see known ip's (as far as I can tell, or am I making a mistake here?). But they say there's a mismatch with the local ip's. So I imagine they do not just use the ip they see the incoming data from but also the local ip of the client (vpn ip) and that is unknown. This is how I can explain/understand anyway.

I was hoping we could use an existing fortinet subnet for VPN-clients which is in de lan subnet of the secure router as Microsoft RRAS can also do that (vpn users get ip from local office lan).

[hbac]

Hi @ILC-Europe,

It would be better to add another known/allowed subnet on the application server side. 

Regards,