SSL VPN with WLLB

[shamilsystems]

Hi, I tried to create virtual-wan-link (WLLB) with 3 WAN links such as WAN1, WAN2, VLAN500(port 16). I did created a default route with WLLB as well. When the default route as WLLB, issues are as below 1) SSLVPN can connect but there is not route from SSLVPN address range to LOCAL-LAN. So there is no communication between sslvpn users and internal LOCAL-LAN. 2) Group of Devices in LAN couldn't connect to internet when assigning any Outgoing interface individually other than "wan-load-balance". Look forward to your response and support soon. Thank you. Regards Shamil

[Somashekara_Hanumant]

Hi Shamil,

For the first question:

> Have you mentioned the Local LAN address on SSLVPN firewall policy as destination address, and also on SSLVPN respective portal, have selected the same network under 'Routing Address"

Kindly provide the below command output from SSLVPN client (at the command prompt) after connecting the SSLVPN

route print

From the FortiGate CLI kindly provide the below command output

get router info routing-table all

get router info routing-table detail

For the second question:

When you reproducing the issue, kindly collect the packets from the below command and then try to access www.fortinet.com from one of the affected LAN user

diag debug reset diag debug enable diagnose debug flow filter addr x.x.x.x diagnose debug flow filter port 80 diag debug flow show console enable diag debug flow show function-name enable diag debug flow trace start 200

(where x.x.x.x is a www.fortinet.com IP address)

After initiating the above commands on the ssh session then try to browse fortinet.com

Regards,

Somu

[shamilsystems]

Dear Somu,

I here attached the log.

But the 2nd one i didnt get that which address to be there in x.x.x.x (is it host IP or fortinet.com IP address);

"diagnose debug flow filter addr x.x.x.x (where x.x.x.x is a www.fortinet.com IP address)"

Please clarify me. Thank you.

Shamil

[shamilsystems]

Dear Somu,

The issue was rectified with the help of fortinet support call. Actually the issue was due to a wrong WLLB rule was mentioned. Now SSLVPN clients able to connect and succesfully can ping, rdp, etc.

But the second issue still remains;

According the Fortinet, WAN-load-balance must got to use for all the outgoing internet communications.

Also fortinet mentioned that;

I got to use policy route for specified source and destination,

Device group cannot be used to do to policy routing, must use different subnet.

Here in my case my client pc's are in local - which ip's are provided by dhcp - all local client's pc in same subnet.

So.. I came in to decision that I split one pppoe link the WLLB in a thought of using that PPPOE link for a DeviceGroup to communicate with internet. And tried to assigned to a policy. Its failed. Please advice.

Thank you.

Shamil

[Mehdi]

Hi Shamil,

you can write a Policy Route for your DeviceGroup to route their traffic to one of your wan links.

if it didn't work, take a pic from your routes, and your Policies and post here.

Please rate if it help.

[shamilsystems]

FG100D3G14816093 # get router info routing-table details Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP        O - OSPF, IA - OSPF inter area        N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2        E1 - OSPF external type 1, E2 - OSPF external type 2        i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area        * - candidate default S*      0.0.0.0/0 [1/0] via 172.16.10.1, wan1, [0/255]                   [1/0] via 172.16.20.1, wan2, [0/254]                   [1/0] via 10.233.33.32, ppp1, [0/253] C       10.233.33.32/32 is directly connected, ppp1 C       172.16.10.0/24 is directly connected, wan1 C       172.16.20.0/24 is directly connected, wan2 C       175.138.57.43/32 is directly connected, ppp1 C       192.168.1.0/24 is directly connected, mgmt C       192.168.10.0/24 is directly connected, lan                         is directly connected, lan C       192.168.11.0/24 is directly connected, WiFi-Aps

[Mehdi]

which network is for your DeviceGroup?

and you said:

"Device group cannot be used to do to policy routing, must use different subnet"

Why? how Fortigate see your DeviceGroup?

also if in DeviceGroup is not too many Device, you can use /32 Subnet to write Policy route for them.

[shamilsystems]

Hi,

All Degicegroups are in same subnet. Fortinet seeing all device groups as windows devices.

[Mehdi]

Which subnet is for your DeviceGroup?

What's the subnet?

[shamilsystems]

My subnet is 192.168.10.0/24. all of my devices and devicegroups are under same subnet.