Setup Site to Site VPN on 60F with SSL

[ForgetItNet]

Hi all,

I've had a look on the internet and on the forum but I can't see any instructions on setting up a site to site VPN using SSL ? There are a couple of posts asking this but no responses and I've been informed by a colleague that this option is now available on these ? We have IPSEC at the moment but due to some other issues we can't use it at another site so SSL is our only option currently.

Can anyone point me in the right direction ?

Thanks

[distillednetwork]

Site to Site tunnels are only going to be IPSEC and not SSL.  Maybe you heard something about SSL-VPN in tunnel mode, but that is just client-to-server.  Will NAT-T not help with the site you are having problems with?

[ForgetItNet]

Ah, maybe we've mis-understood this then. It's to use on some very remote sites that we are potentially looking at using Starlink broadband but we've been told it doesn't work with IPsec site to site VPNs (or at least pass it through) so would we be able to create a site to site SSL VPN using one Fortigate as the client and one as the server or is the SSL VPN purely for a machine to router and not router to router ?

Thanks

[akristof]

Hello,

Maybe you are looking for this?

https://docs.fortinet.com/document/fortigate/7.0.0/new-features/508779/fortigate-as-ssl-vpn-client

This is doc how to make SSLVPN connection between 2 FortiGates where one is SSLVPN Server and one SSLVPN Client.

[ForgetItNet]

Thanks akristof, yes, i think that's what i'm looking for. Wil this allow us to route between other sites past the "server" side as we use BGP at the moment so not sure if we'd have to manually add static routes in this scenario ?

[ForgetItNet]

I've gone through that guide and set it up correctly (as far as i can tell) but nothing is happening....apart from checking the SSL-VPN connected users on the "server" router how do i know if it's even trying to dial up on the client side as there's no "connect" button or anything ?

[akristof]

Hello,

To be honest, never saw this configured on customer's equipment and I didn't test this in lab. But it should automatically try to connect. Go into SSLVPN Widget on dashboard or you can try enable sslvpn debug to see negotiation:

diag debug app sslvpn -1

[ForgetItNet]

Thanks, so i'm getting no results at all from the debug or the widget so i think i'm missing something simple and fundamental here.

Just so I'm clear...we already have the SSL VPN component set up on our head office router as that's what we use with the remote workers laptops so on the router that's acting as the client is it ONLY the SSL-VPN Clients "bit" where I need to set anything up ? I don't need to set anything in the SSL-VPN settings do i as i "assume" that's for using it as a server ?

[ForgetItNet]

Just as an update that although i can't see ANY logs in the client router i can see loads on the server side but they just say "SSL Exit Error" and that's it...there's nothing really that i can see in the error itself but the Remote IP in the event each time is the client routers WAN ip ?

Not sure if that helps ?

[ForgetItNet]

Just to close this off that i managed to get this going just by creating a new PKI user (now that the option was available) and then selecting the CA as CA_Cert_1 and not trying to enter any Subject line in there or doing the CLI bits in the guide and then did the same on the "client" router and all worked fine. Thanks all