creating VPN IPSec on Fortigate 100E

[longtran_cntt]

Hi all, this is my topology - Firewall Fortigate 100E - WAN1 and WAN2 - VLAN1, 2, 3 and DMZ go through WAN1. I have configured:  - VLAN2 can access DMZ. I want to config like below: - VPN IPSec from outside go through WAN1 public IP and the client will be assigned IP of VLAN2 in local => user who uses VPN can access to VLAN2 and DMZ. - Already config User group/ VPN range/ IPv4 Policy... I have followed the Fortigate Cookbook for this process, but I can not connect to the local network by using that VPN even when checking user group/ preshared- key/user credential many times. Can you guys help me some solutions?

[hubertzw]

longtran.cntt wrote:

...but I can not connect to the local network by using that VPN even when checking user group/ preshared- key/user credential many times.

Are you able to establish the tunnel? You said you verified pre-shared-key and I'm confused...

[longtran_cntt]

hubertzw wrote:

longtran.cntt wrote:

...but I can not connect to the local network by using that VPN even when checking user group/ preshared- key/user credential many times.

Are you able to establish the tunnel? You said you verified pre-shared-key and I'm confused...

yes, for sure. maybe my bad English made you confused. let me explain more detail about my situation:

- I have a VPN is working well. When I use this VPN to connect to the internal network => I will have local IP is 10.123.5.2.

- I have VLAN2 with subnet 10.123.20.0/24 and DMZ IP 192.168.100.20. Both are running net-in/out on WAN1. On the PC of VLAN2, I can ping to IP of DMZ but not the opposite (DMZ cannot ping VLAN2).

Now, I want to make a rule to let VPN user access DMZ. But after setup IPv4 Policy:

- if disable NAT => ping from VPN (10.123.5.2) to DMZ (192.168.100.20) result: Request timed out.

- if enable NAT => ping from VPN (10.123.5.2) to DMZ (192.168.100.20) result: TTL expired in transit.

that's why I think "how if I create a new VPN with local IP is 10.123.20.200-10.123.20.254, so it will be inside the VLAN2, then I can access DMZ after connect by this VPN as same as local PC inside VLAN2" => but after setup new VPN with those credential above, I cannot make it connect on FortiClientVPN app (always showing message tell me to check network, account information...). 

I would like to as a solution for both ways above, if any.

[sw2090]

Is this a dial up tunnel?

Are you using split tunneling yet?

This is what I do here:

I have an IPSec dial in tunnel to my office. If I dial in it gives me an ip plus (via split tunneling) I get net routes to all our subnets I need to access via the vpn. The Fortigate has some policy to allow traffic from vpn subnet to the other subnets. FGT needs no explicit routes since that is all interfaces (physical or vlan) and so already has routing for it.

This will also affect the "way back". So if you ping from vpn to subnet this also covers the answer to your ping.

You only need policies for the direction subnet to vpn if you explicitely have traffic that initiates from out the subnet and goes to the vpn.

The other issue is that if you do not use split tunneling your complete traffic will go to the fortigate once the tunnel is established...