VPN from Firebox SSL

[yihad92]

I want allow a vpn connection from watchguard by SSL. I already create the public address and create the policy but still unable to connect  to remote server using  firebox ssl.

Any idea  what i am missing?

[Toshi_Esumi]

If you're saying a Watchguard FW is inside of FortiGate and want to the FG to pass the SSL VPN through it, you need to have a proper way to pass the TCP port (default 443) to the Watchguard in addition to routing. Your description is not clear where the public IP resides. At FG or WG?

[yihad92]

Sorry for the delay the Public IP is at the WG.  This WG firewall is on a remote office is not local.

We want to pass through our fortigate to connect to that remote office using the app from WG but i have no idea how to. I tried to add the public address and them create a policy but still nothing so far.

Any idea what can ido ?

[Toshi_Esumi]

So the client is located inside of FGT at local office and trying to connect to the remote WG with SSL VPN?

Then almost nothing would need other than a simple/default NAT policy for the internet at FGT. Are you sure WG is receiving the SSL VPN attempts? I would run debug on WG side if it's receiving them.

[yihad92]

How i do that? And Yes it is receiving the attempt but it gets stuck trying to connect to the server them it fail.

[yihad92]

We are using the app from WG to connect to that site somehow our firewall is blocking it even i added the ip policy.

[Toshi_Esumi]

I guess I'm not understanding what Firebox SSL is. I thought it was a client software to connect to WatchGuard FW via SSL VPN, not the way around.

[yihad92]

Yes , it is a client software : firebox ssl from WG we are using it to connect to the remote office but when we try to use it the connection never pass also is using port 4443 TCP.

[Toshi_Esumi]

You need to make distinction between SSL VPN establishment and application traffic/connections over the SSL VPN tunnels. Then either case, you need to troubleshoot at WG. I would post the question at Watchguard forum then they might tell how to figure out what's happening at WG and what you need to do at in-between FW like FGT. Again, if the client is inside of FGT, a regular internet NAT policy should be enough.

[yihad92]

How i do that configuration for the nat policy and the port 4443 will not be blocked?