Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
random_guy
New Contributor III

SSL VPN without NAT?

Can an SSL VPN  run without NAT?

 

FortiClient 10.200.0.x -> Router 10.0.0.1 -> FGT 10.0.0.10 -> Internal Network 10.0.0.X

 

Running into a problem with internal software trying to connect back to the client but it only sees the client as 10.0.0.10 and not 10.200.0.x. Is it as simple as disable NAT on the policy? Or is there more to it than that?

 

Thanks

1 Solution
Toshi_Esumi

If the internal software makes contact to the clients spontaneously, don't forget to add a policy toward ssl.root.

View solution in original post

8 REPLIES 8
rwpatterson
Valued Contributor III

Scratch this entry.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
rwpatterson
Valued Contributor III

NAT should only be needed on policies facing the Internet. Any policy that doesn't reach out to public space should be safe to have NAT disabled.

Bob - self proclaimed posting junkie!
See my Fortigate related scripts at: http://fortigate.camerabob.com

Bob - self proclaimed posting junkie!See my Fortigate related scripts at: http://fortigate.camerabob.com
random_guy

OKay, so I can simply disable NAT on the policies... I'll give it a go.

Toshi_Esumi

If the internal software makes contact to the clients spontaneously, don't forget to add a policy toward ssl.root.

random_guy

toshiesumi wrote:

If the internal software makes contact to the clients spontaneously, don't forget to add a policy toward ssl.root.

So I just tried disabling it on policy 3 below and while the VPN connection stayed, I couldn't RDP in so I must have a problem with the policy. What else would I be missing?

 

edit 3 set name "RDP" set srcintf "ssl.VPN" set dstintf "port3" set srcaddr "SSLVPN_TUNNEL" set dstaddr "RDP Clients" set action accept set status enable set schedule "always" set service "RDP" "DNS" set utm-status enable set logtraffic all set groups "RDP_Only" set av-profile "g-default" set ssl-ssh-profile "certificate-inspection" set nat enable next

 

edit 4 set name "To_SSL_Clients" set srcintf "port3" set dstintf "ssl.VPN" set srcaddr "all" set dstaddr "SSLVPN_TUNNEL" set action accept set status enable set schedule "always" set service "ALL" set nat enable next

Toshi_Esumi

I would drop the service limit, currently you have RDP and DNS, then just test with ping to the destination. I'm assuming it wouldn't work. Then start debugging with sniffing and "flow debug" to see why even ping doesn't come through.

emnoc
Esteemed Contributor III

routing???

 

Tip 

 

"diag sniffer packet ssl.root " when doing your test. Check before and after nat is enable. Look at the src ? Can the far end reach back to it?

 

ssl.root is a interface treat it like any other interface.

 

Ken Felix

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
random_guy
New Contributor III

emnoc wrote:

routing???

 

Tip 

 

"diag sniffer packet ssl.root " when doing your test. Check before and after nat is enable. Look at the src ? Can the far end reach back to it?

 

ssl.root is a interface treat it like any other interface.

 

Ken Felix

Wish I would seen this when I was testing! Clients would lose connectivity immediately when disabling NAT on the policies. Tunnel would stay up but could not reach anything.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors