VPN Dialup with FortiClient, no access to remote network

[Pathfinder]

Hi all

I'm new in the forum and i'm also pretty new on fortinet-products. I try to set up a remote vpn wich is accessible through FortiClient. The wizard is very simple to handle. I can choose the nessesary settings. But after the wizard is done, i have a problem in the configuration of the tunnel. The first section "Network" is shown red. When editting, the "Accessible Notworks" field is clear. When setting the local network manualy and safing, it doesn't work. Next time i want to see details of the config the filed ist still clear.

My Config:

FortiGate 100D with FortiOS v5.4.0,build1011

LAN1 IP 192.168.20.1 (FG100D)

Local Subnet: 192.168.20.0/24

IP-Range for FortiClients: 192.168.21.1-192.168.21.254

WAN accessible over fixed IP

User and User-Group are set correct

When i try to connect with FortiClient from outside, i have a connection to the firewall, but not to the remote network.

That seeems logic, because there is no accessible network set in forticlient-config.

But how can i get this run?

regards

Pathfinder

[ede_pfau]

Notworks

very nice, greetings from Freud!

Never mind, welcome to the forums.

At the moment I cannot guess what is different from a standard setup which always works. Maybe you could post a screenshot of the VPN phase1 and phase2 - we're talking about IPsec, aren't we?

[Pathfinder]

Hi Ede

Very nice Freud, in deed. Yes we're talking about IPsec.

Without converting the tunnel to custom tunnel i'm not able to see the details of phase1 and 2.

I will do this to find the error.

Tunnel Config after creation with wizard

Tunnel, error in network-settings

Tunnel, after converting to custom tunnel

After converting to custom tunnel phase 2 is empty. very strange.

I can modify phase 2 with correct Netmasks. That works.

But i can still not change the "Accessible Networks" field, wich ist still red.

Regards

Marc

[ede_pfau]

Do you have an address object defined representing your internal LAN address range? This should go into the red field.

[Pathfinder]

yes, i have. it's called "Subnet_20" and it's a netmask with 192.168.20.0/24.

but when i choose this object and save config, next time i open it, it will be still red and empty.

[ede_pfau]

Please change the client address range to "192.168.21.0/24" and try again.

[Pathfinder]

Hi Ede

Sorry, i was out of house the whole day.

I'n not able to set the ip-adress with mask /24. The field turns red an i cannot save that config.

That's because the adress-range is also the range of ip-adresses wich the clients are provided with in forticlient to connect to the tunnel.

Marc

[ede_pfau]

Nope, the ranges are distinct, right - .20.0/24 for LAN and .21.0/24 for the clients ?

[Pathfinder]

Sorry for my late answer. I also tried to solve the problem with fortinet support.

The answer was scaring. Now i'm willing to go back to FortiOS 5.2.x

The supporter wrote:

As mentioned this what I was sending was based on 5.0/2 because nobody is working with 5.4 too buggy.

I will try to solve the problem, as soon as i have downgraded to 5.2.x.

regards

pathfinder