SSL VPN to Site2Site VPN

[pprior]

Hi!

I've 2 Fortigate 40 with a IPSEC tunnel, working great.

Then in each one, I've a SSL vpn for client pc's, they can access local lan in both sites.

Problem is I need to allow access to Site 1 using SSL vpn on Site2.

Tried to adapt this https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/45836/ssl-vpn-to-ipsec-vpn but cant get it to work.

On Site2 I created a policy to allow SSLVPN traffic to access the VPN tunnel:

Income - SSLVPN

Outgoing - IPSEC Tunnel

Source - IP range for SSL and the ssl user group

Destination - The remote subnet on Site1

Tried with and without NAT, but doesnt work.

Don´t I need a policy to allow in Site1 also? Tried that also, but doesnt work.

Can anyone help or point another example?

Thansk in advanced

[pprior]

Got his info:

get router info routing-table details 10.212.130.1

Routing table for VRF=0
Routing entry for 0.0.0.0/0
Known via "static", distance 5, metric 0, best
* ext.ip.98.1, via lan3

[pprior]

SOLVED!!!

after creating a static route and a policy to allow traffic from SITE1 to SSL VPN in SITE 2, it started pinging.

Thank you NTANEJA and all  the other for the support!

Great Forum.

[Muhammad_Haiqal]

Hi there,

FGT1 IPSEC with FGT2.

SSLVPN connect to FGT2.
You want to access network on FGT1.

Here is the general idea:

On FGT2:

Income - SSLVPN

Outgoing - IPSEC Tunnel

Source - All

Destination - All

No NAT

ON FGT1 and FGT2.
On IPSEC phase2, please include SSLVPN ip range.
Looking at your summary, you are missing SSLVPN range on the Phase2.

[pprior]

Hi, thanks for the help!

Even with the address groups including site2 lan and site vpn subnet, still doesnt work...

[Muhammad_Haiqal]

Please add the phase2 on both site. Make sure your static route using "to_FV_remote" Interface Site2Site. Im suspecting this issue related to routing now.

[EEHC]

These are the first points I would going to ask about.

[EEHC]

I believe we have to check routing at the ends to ensure that the packets go through the tunnel. Also, we could check the log on FortiGate to confirm that the correct policies are matched. Normally, problems start at the routing and ends at the policy.