Server IP address could not be found for IPsec VPN Remote Access

[pxiannie]

Hi, I'm trying to remote access to local lan using forticlient. I'm able to connect to IPsec VPN and ping 192.168.1.1 but cannot ping my server ip address and access to local server. Is there any problem for my settings? My server ip address also one of the range in Local-LAN but why I cannot ping my server? Please help.


Regards,

[pxiannie]

Hi @ebilcari, 
 

I'm able to ping my server and access local system after add the server ip address and servername to the hosts file.  But that works for FortiClient desktop only, is there any way to solve the dns resolution problem after connect using FortiClient mobile app?

Regards,

[ebilcari]

Yes, you can change the VPN settings, push FGT as the DNS server and add an A record for this server. Configuration steps are shown in this article.

[pxiannie]

Hi @ebilcari ,

I'm using IPsec VPN, is there any solution for IPsec? I dont have the domain "xxx.com" . How to make the server ip address match with the servername "xxxserver" in FortiClient mobile so that I can access Active Server Pages (http://xxxserver:8484/Login.aspx) ?

Regards,

[ebilcari]

The DNS server configuration is the same as shown on the article for SSLVPN. To apply that on IPSec follow this or this article.

[Patron]

Not sure how you set it up, but you might need to add a route in the firewall explicit for the tunnel range.

Because you are using NAT and it works, it looks like that's the issue

[Durga_Ashwath]

Hello Team,

 FortiGate device is attempting to establish a connection to the FortiGuard server at IP address 173.243.143.6. This IP address does not belong to the 192.168.1.x subnet, so it's unlikely that it uses .1 as the gateway within that subnet.

Regarding firewall rules on the server, it's essential to check if there are any specific rules that might be blocking traffic from the source IP addresses of the FortiGate device or VPN clients. If there are restrictive firewall rules in place, they could potentially block the communication between the FortiGate device and the FortiGuard server.

Additionally, if NAT is not enabled on the firewall policy that allows traffic from the FortiGate device to reach external servers like the FortiGuard server, the requests will indeed be sourced by the IP of the VPN client. This means that the firewall rules on the server should allow traffic from the VPN client IPs as well, not just from the FortiGate device's IP.

In summary, it's crucial to:

1. Check if the FortiGuard server's IP address is within the 192.168.1.x subnet and if it uses .1 as the gateway (if applicable).
2. Review firewall rules on the server to ensure they allow traffic from both the FortiGate device's IP and the VPN client IPs.
3. Consider enabling NAT on the firewall policy if necessary, to ensure that requests are sourced correctly.

Thank you.

[pxiannie]

Hi @Durga_Ashwath ,

I'm able to ping my server and server ip address in computer after added server name and server ip address in hosts file. But I still not able to access my local system in mobile, how to solve dns resolution problem in mobile? 

Regards,