Site to Site VPN GUI Issue' s

[GarethWest]

Hi, We are running 2x 200D' s at our HQ site in HA mode. We have a mixture of 60C, 80CM and 90D' s at our remote sites. Recently I' ve been upgrading our 60C' s to 90D' s to allow more FortiAP' s devices. On the 90D' s, I updated the firmware to 5.0.7 and have found I cannot access the Web Interface over the VPN from HQ, but could on the local subnet and also through SSL VPN. I' ve even updated one of the 90D' s to os 5.2 but still the issue appears. This doesn' t seem to be an issue on other model' s running these firmware versions. Has anyone seen this before?

[Istvan_Takacs_FTNT]

And you have HTTP/HTTPS access enabled on the interface you try to connect to?

[ede_pfau]

And do you have specific non-wildcard Quick Mode identifiers in your phase2 setup? Which of course should cover the FGT' s interface address. Additionally, I' d get both configs (again) from the old 60C and the 90D and compare them (in a tool) for differences, line by line.

[GarethWest]

Thanks for the replies. I do have HTTP/HTTPS access enabled and it seems to work fine locally, its just over the VPN. Thanks Ede, I' ll compare both configs, just seems odd that its only the 90D' s I have a problem with. Gareth

[MikePruett]

Did you ever find a resolution to this issue?

I am experiencing the same problem. It only happens when I am attempting to connect via a FortiAP though, the built in antenna works fine.

For instance, I am at a remote site now. If I make it to where the network that has access to the IPSEC tunnel is ONLY broadcast on the built in wireless radio of the FortiWIFI, I can access the administrative panel of the HQ Fortigate just fine.

If I try to connect via the same SSID while being broadcast from the FortiAP device that is operating in tunnel mode (everything else is identical policy etc) I get nothing but time outs.

Very strange and frustrating. I originally thought it was some weird FortiWIFI vs FortiAP conflict issue taking place but now that I have deployed a FortiGATE 92D where I am at with a 321C I am unable to access the HQ fortigate administrative panel. This is a FortiGATE not a FortiWIFI now so my normal work around of having the internal antenna control the work network isn't available haha.

Take note that all other access over the tunnel operates fine (shares, web administrative panels for non fortinet equipment etc). It is only Fortinet hardware I am unable to access (the FortiAnalyzer, FortiManager and FortiGATE administrative interfaces (HTTPS) via the tunnel.

[MikePruett]

The solution to this issue is as follows:

Solution: Change the MTU of the policy or the interface that is being accessed over the CAPWAP tunnel to something less than 1500. I had to set mine to 1366. I originally set this on the policy (set tcp-mss-sender and set tcp-mss-receiver) that was allowing the traffic for testing purposes and later applied it to the interface. Below is how you apply it to the CAPWAP interface itself.

Config wireless-controller wtp

edit YOURWIRELESSCONROLLERHERE

set override-ip-fragment enable

set tun-mtu-uplink 1366

set tun-mtu-downlink 1366

next

end

Cause: The CAPWAP overhead for the FortiAP tunnel back to the network associated with the SSID is the culprit. When you include the normal packet + the overhead of the tunnel back to the wireless controller it causes it to go over the 1500 default and makes things fragment. When accessing items over the IPSEC tunnel this causes all sorts of issues.

Performing this task resolved my issue and I am now able to access all remote network resources without issue.

This also explains why I could make my work network only broadcast from the FWF antenna and it would function fine (because it didn't tunnel back).