SSLVPN traffic FGT1 unable to communicate FGT2

[ingchristo]

I have a LAN with 2 FGT's.  SSLVPN coming in to FGT1 can not reach FGT2 and server on FGT2.  Not sure where my issue might be.

[AEK · Accepted solution]

Did you add a route on FGT1 like this?

• Dest: <server-subnet>
• Port: portX
• GW: 192.168.10.254

And on FGT2 like that?

• Dest: 192.168.100.0/24
• Port: portY
• GW: 192.168.10.252

And firewall rules on both FG1 and FG2 to allow the related traffic?

[ingchristo]

Adding these static routes did the trick.

[nathan_h]

Hi ingchristo,

You can check the routing by the commands below.

get router info routing-table details <source>
get router info routing-table details <destination>

Run a packet capture and initiate traffic on where the packet is drop.

diag sniffer packet any 'host <source> and host <destination>' 4 0 l

Verify the Firewall policy based on the routing   table.

[maulishshah]

Hi, 

Can you please provide the routing table from FGT1 for a server?

get router info routing-table details x.x.x.x (server IP)

In addition, as previously mentioned we need to have a firewall rule from SSLVPN to Lan with particular subnets. 

If all configuration is fine, we would like to run the debug on both of the firewall

di de reset

di de flow filter clear

di de flow filter addr x.x.x.x (x is the server ip)

di de flow filter proto 1

di de flow trace start 999

di de en

Note: Please initiate the ping after applying the above debugs from the user who connects the SSLVPN

[Hsharma]

Hi,

You also have to check ,if the destination route is printed in the routeprint output on the device connected to the vpn . If Routes are not present in the routeprint output then might be split tunneling is enabled and you might need to add the destination route in the splittunnel.

Thank you