VPN SSL not browsing Internet

[techinfofao]

Fortigate 60 C

v5.2.10,build742

Hello.

My VPN users are able to connect to the SSL VPN.

The local address subnet are resolved and users can access to shared folders but

they cannot browse Internet (Computers in the local subnet can)

Split tunneling is disable on all portals.

What's wrong ? : policy, route, .... ?

Any ideas are welcome.

Thank you.

[moby]

Hi - -Do you have a policy from SSL root to your internet interface - where the source is your SSL VPN addresses and destination is all with nat enabled?

Moby.

[techinfofao]

Hi, Moby.

Yes, i have this policy with NAT enable.

[moby]

Hi Can they ping an Internet address such as 8.8.8.8  - maybe it is a DNS issue.

Moby

[techinfofao]

No i can't ping an Internet address such as 8.8.8.8

What could be wrong about my DNS ?

Thx

[moby]

Hi,

If you are connected to the SSL VPN and you cannot ping 8.8.8.8 then this issue is not DNS - the SSL VPN user need to be able to reach a DNS server though of course  - but in your case you cannot even ping by IP therefore there must be something else wrong. Probably you should do a diag debug flow:

diag debug reset

diag debug enable

diag debug flow filter saddr (IP of SSL VPN client)

diag debug flow filter daddr 8.8.8.8

diag debug flow show console enable

diag debug flow trace start 50

Then run your ping to 8.8.8.8 from an SSL VPN connected machine - the debug output may help to determine what is wrong.

Moby

[techinfofao]

Her is the debug output, thx :

FGT60C3G11037937 # id=20085 trace_id=1 func=print_pkt_detail line=4478 msg="vd-root received a packet(proto=1, 10.0.0.1:1->8.8.8.8:8) from ssl.root. code=8, type=0, id=1, seq=148." id=20085 trace_id=1 func=init_ip_session_common line=4631 msg="allocate a new session-002d76d7" id=20085 trace_id=1 func=vf_ip4_route_input line=1596 msg="find a route: flags=00000000 gw-95.141.102.40 via ppp2" id=20085 trace_id=1 func=fw_forward_handler line=561 msg="Denied by forward policy check (policy 0)" id=20085 trace_id=2 func=print_pkt_detail line=4478 msg="vd-root received a packet(proto=1, 10.0.0.1:1->8.8.8.8:8) from ssl.root. code=8, type=0, id=1, seq=149." id=20085 trace_id=2 func=init_ip_session_common line=4631 msg="allocate a new session-002d7778" id=20085 trace_id=2 func=vf_ip4_route_input line=1596 msg="find a route: flags=00000000 gw-95.141.102.40 via ppp2" id=20085 trace_id=2 func=fw_forward_handler line=561 msg="Denied by forward policy check (policy 0)" id=20085 trace_id=3 func=print_pkt_detail line=4478 msg="vd-root received a packet(proto=1, 10.0.0.1:1->8.8.8.8:8) from ssl.root. code=8, type=0, id=1, seq=150." id=20085 trace_id=3 func=init_ip_session_common line=4631 msg="allocate a new session-002d7834" id=20085 trace_id=3 func=vf_ip4_route_input line=1596 msg="find a route: flags=00000000 gw-95.141.102.40 via ppp2" id=20085 trace_id=3 func=fw_forward_handler line=561 msg="Denied by forward policy check (policy 0)" id=20085 trace_id=4 func=print_pkt_detail line=4478 msg="vd-root received a packet(proto=1, 10.0.0.1:1->8.8.8.8:8) from ssl.root. code=8, type=0, id=1, seq=151." id=20085 trace_id=4 func=init_ip_session_common line=4631 msg="allocate a new session-002d7888" id=20085 trace_id=4 func=vf_ip4_route_input line=1596 msg="find a route: flags=00000000 gw-95.141.102.40 via ppp2" id=20085 trace_id=4 func=fw_forward_handler line=561 msg="Denied by forward policy check (policy 0)"

[moby]

Hi  - So when the packet comes in destined to 8.8.8.8 the firewall looks up the route and finds a route with a next hop of 95.141.102.40 via interface ppp2  - -then it seems that there is no policy to allow the traffic from SSL root to whatever interface PPP2 is bound to - therefore the traffic is denied by forward policy check as shown below.

id=20085 trace_id=2 func=vf_ip4_route_input line=1596 msg="find a route: flags=00000000 gw-95.141.102.40 via ppp2" id=20085 trace_id=2 func=fw_forward_handler line=561 msg="Denied by forward policy check (policy 0)"

You should check your policy again.

Moby.

[techinfofao]

OK.

I will check policy again.

Thanks for your help and Happy new year. (I am out until January 2017)

[dmanriquez]

Hello everyone, I have the solution:
Setup SSL VPN in tunnel mode with split-tunneling, on a FortiGate unit running FortiOS firmware version 5.0, 5.2 or greatrer.
I Have Fortigate 100D OS 5.4.2

The requirements are:

    PC user should access all internal resources via the SSL VPN gateway in tunnel mode.
    PC user should access all other internet destinations with its local gateway.

Steps to follow:

Create IP Groups

2. Configure the VPN portal3. Configure the SSL VPN

4. Create the route

5. Create the Policy

6. END and tests

NOTE:Attach a document with FORTINET images that explains the steps to follow