connect to remote vpn site through forticlient

[Raffael_Hotz]

Hello there,

I have 3 sites, A,B,C. A and C with public IP, B behind NAT. I have set up a Site-to-Site VPN between A and B, A and C and B and C. So far so good, I can work with all sites when I am in one of the local subnets. But now, I want to work remotely. With the Forticlient I can already connect to each site. But I don't wont to connect to each site, I want to connect to one site and manage all 3 sites.

I thought it is enough to do policies like "forticlient_interface" to "vpn_A" ,"forticlient_interface" to "vpn_b" and "vpn_A" to "forticlient_interface", "vpn_B" to "forticlient_interface". The Forticlient VPN is in the same management subnet 10.0.1.0/24 from where i can reach all sites when I am connected locally

Is there anything I am missing?

Hope you guys can help.

Thanks,

Raffael

[Toshi_Esumi]

Check 1) routes, 2) policies, and 3) network selectors (phase2) especially at the remote sites. They need to know the the client subnet and where (VPN) to route to, and it needs to be allowed by policies and selectors.

[tranhuyvu]

You're having the same /24 network on each site on your SSL VPN interface. That's the reason why you can't reach other 2 sites once you're connected to one. Here's an example of what you should do.

Assign 10.0.1.0/24 to site A, 10.0.2.0/24 on site B, 10.0.3.0/24 on site C.

On site A, create 2 static route. 10.0.2.0/24 goes to A-B tunnel. 10.0.3.0/24 goes to A-C tunnel

On site B, create 2 static route. 10.0.1.0/24 goes to A-B tunnel. 10.0.3.0/24 goes to B-C tunnel

On site C, create 2 static route. 10.0.1.0/24 goes to A-C tunnel. 10.0.2.0/24 goes to B-C tunnel

Then create policies on each tunnel accordingly.

[Raffael_Hotz]

Hi,

thanks for the anwsers. So no, I dont have the same subnets. They are 10.0.1.0/24, 10.10.1.0/24, and 10.20.1.0/24. The thing is, if I am on site, I am in the same subnet as I am when connected via Forticlient and then everything works fine. So i guess it is not a static routes thing, no?

I will try and check my policies.

Thanks so far

[sw2090]

it can (and prolly is) still a static routing thing on your client.

When you are on Site and connected the net you have a static route via your interface that is connected to the subnet.

If you are connected by vpn you have an interface in the vpn subnet (which is usually not the same) and no route at all to your office subnet.  

So in this case you either need to enable split tunneling or have the forticlient rewrite your default route havng all your internet traffic going via office FGT too. Plus of course you need policies from vpn to office subnets.

[Raffael_Hotz]

Its working. I disabled split tunneling and redone the Client VPN and magic happened and it is working now.

Thanks guys!

[sw2090]

ok but keep in mind that now ALL your traffic from client goes through the VPN!

If you don't want this to happen you must re-enable split tunneling and set it to an address group containig all subnets you want to access plus make sure you have the neccessary policies.