VLAN access over SSL VPN

[snipor]

Hello,

I’m experiencing an issue with an SSL VPN setup on my Fortigate, and I’d appreciate some guidance. Here’s the scenario:

There are multiple VLANs (e.g., 100, 200, 300, and 400), and the Fortigate handles the routing between them. Within the local network, devices in VLAN 100 can access VLANs 200, 300, and 400 without any issues, as there are existing firewall rules in place to allow this.

The SSL VPN is configured in Tunnel Mode with the setting Enabled Based on Policy Destination.

SSL VPN Portal Settings:

• Routing Address Override: Unconfigured
• Source IP Pools: SSLVPN Tunnel Address Range

Firewall Policy for SSL VPN:

• Incoming Interface: ssl.root
• Outgoing Interface: VLAN 100
• Source: SSLVPN Tunnel Address Range and VPN User Group
• Destination: VLAN 100 Address Range
• Service: All
• NAT: Disabled

When a client connects to the Fortigate via FortiClient VPN, they can access resources in VLAN 100 as expected. However, they are unable to access devices in VLANs 200, 300, or 400.

It appears that the routing rules which normally allow inter-VLAN communication do not apply to traffic coming through the SSL VPN (ssl root interface).

I’m using a Fortigate 90G running firmware version 7.4.5.

Is there a way to configure the SSL VPN so that users behave as if they are directly in VLAN 100, allowing them to take advantage of the same routing and firewall rules already in place? Or is there something missing in my configuration?

Thank you in advance for your help!

[sjoshi]

have u created firewall policy between the ssl vpn interface and the other vlan. If yes try to enable nat and check

[snipor]

No, there is only the firewall policy described above, which routes SSL VPN traffic to VLAN 100.

My question was whether I need to replicate all the existing local rules for VPN traffic, or if there is a way to make the SSL VPN user essentially land directly in VLAN 100 (said in easy words) and use the already existing local rules.

[sjoshi]

Hi snipor,

yes you need to create same policy for other vlan too from ssl vpn to vlan 200,etc.

Q) If there is a way to make the SSL VPN user essentially land directly in VLAN 100 (said in easy words) and use the already existing local rules

A) No that is not possible. You need to create the rule like you did for vlan 100

[distillednetwork]

You will need to replicate the policies for SSLVPN.   The SSL VPN is a different interface on the firewall and can not be seen as the same network as VLAN 100.

[dingjerry_FTNT]

Hi @snipor ,

You just need to replicate the current SSL VPN policy for VLAN 200/300/400 respectively:

new Firewall Policies for SSL VPN:

• Incoming Interface: ssl.root
• Outgoing Interface: VLAN 200/300/400
• Source: SSLVPN Tunnel Address Range and VPN User Group
• Destination: VLAN 200/300/400 Address Ranges
• Service: All
• NAT: Disabled

[callmeahero]

Your SSL VPN users can access VLAN 100, but not the other VLANs (200, 300, 400), because the firewall rules that allow inter-VLAN traffic don’t apply to traffic from the SSL VPN interface (ssl.root).

To fix this:

- Add Firewall Policies for SSL VPN Access to Other VLANs: You need to create new rules that allow - SSL VPN users to access VLAN 200, 300, and 400.

For example:

-Incoming Interface: ssl.root
-Outgoing Interface: VLAN 200 (and repeat for VLANs 300, 400)
-Source: SSL VPN IP Pool
-Destination: VLAN 200 IP range (and repeat for VLANs 300, 400)
-Service: All
-NAT: Disabled

Routing: Check if routing between the SSL VPN and VLANs is set up correctly, and that the  FortiGate is allowing traffic from the VPN to those other VLANs.

This should allow SSL VPN users to access all the VLANs as expected.