VPN can connect but can't access shared folder

[rtuesca]

Hi all, Using Forticlient IPSec VPN to connect back to office network unable to access network shared Please help. The shared folder is only shared by domain PC. I can ping IP, nslookup and ping hostname of the PC.

Thank you

Regards,

RTuesca

[gfleming]

Is your FW policy allowing access on SMB/file share protocol?

Is your PC local firewall preventing the traffic?

let's start there and then troubleshoot further...

[rtuesca]

Yes, as of the moment we allow all on the Forti and I also tried turning off the firewall of the shared PC but no luck on that one.

Thanks

RTuesca

[gfleming]

It looks like you are accessing the file share using hostname instead of IP.

Can you please try with IP?

Chances are you will need to set up split DNS config on your VPN settings to be able to access resources using hostnames (note only FQDN will work).

[rtuesca]

I've tried accessing it through IP still the same, What do you mean by setting up split DNS config on VPN settings? so I can raise this with our network engineer. I've also try accessing the shared PC via FQDN

DNS Config is this something can be done on forticlient VPN? or this is need to be done on the Fortigate Itself?

[gfleming]

OK we need to see what's happening to the traffic on the FGT. Please issue the following commands:

diagnose debug enable
diagnose debug flow filter saddr (IP address of VPN client)
diagnose debug flow filter daddr (IP address of file server)
diagnose debug flow trace start 15

After issuing those commands please attempt connection to the file server and paste output here.

Here is info on split DNS: https://docs.fortinet.com/document/fortigate/7.2.2/administration-guide/988717/ssl-vpn-split-dns

[rtuesca]

Hi Gfleming,

We already figured out the error; it looks like the FW is blocking the traffic. but it's already working now. Thanks, your help is much appreciated.

Thanks

RTuesca