ipsec vpn / access local printer

[bashrael]

Hi,

I want people to be able to connect to our office over vpn.  

When they do this I prefer all their internet traffic also goes through our fortigate.

This works when I setup a ipsec vpn without split tunnel.

But some users need to be able to print on their local network printer.

If I set up a split vpn tunnel this works but then the internet traffic goes over their local gateway.

So how can I solve this?

I'm on fortios 5.2.10

thanks!

[Toshi_Esumi]

no split-tunnel vpn shouldn't break local LAN device access. Just default route going into the tunnel.  If remote user's PC is 192.168.1.10/24 and he/she should be able to reach a printer with 192.168.1.100 regardless the tunnel is up or not. Did you check the routing table on the PC when the tunnel is up?

[bashrael]

hi tx for the answer.

my local network 192.168.4.0/24

vpn 10.10.254.100-10.10.254.150

this is the routing table:

IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.4.100 192.168.4.54 36 0.0.0.0 0.0.0.0 10.10.254.101 10.10.254.100 1 10.10.254.100 255.255.255.255 On-link 10.10.254.100 257 remote ip 255.255.255.255 192.168.4.100 192.168.4.54 35 127.0.0.0 255.0.0.0 On-link 127.0.0.1 331 127.0.0.1 255.255.255.255 On-link 127.0.0.1 331 127.255.255.255 255.255.255.255 On-link 127.0.0.1 331 169.254.1.1 255.255.255.255 10.10.254.101 10.10.254.100 1 192.168.4.0 255.255.255.0 On-link 192.168.4.54 291 192.168.4.54 255.255.255.255 On-link 192.168.4.54 291 192.168.4.255 255.255.255.255 On-link 192.168.4.54 291 224.0.0.0 240.0.0.0 On-link 127.0.0.1 331 224.0.0.0 240.0.0.0 On-link 10.10.254.100 257 224.0.0.0 240.0.0.0 On-link 192.168.4.54 291 255.255.255.255 255.255.255.255 On-link 127.0.0.1 331 255.255.255.255 255.255.255.255 On-link 10.10.254.100 257 255.255.255.255 255.255.255.255 On-link 192.168.4.54 291

So if I look at this I think its normal i cannot reach my local network.

0.0.0.0 0.0.0.0 10.10.254.101 10.10.254.100 1

this catches everything and send it to my remote network.

If I use a split tunnel the metric of this route is much higher

So I guess I need to change the metric of that route and put a route before it that points to my local network.

I could program it on my local computer but thats no solution since I dont know what lan other users will have.

So how do I do this on the fortigate?

tx

[scuba1900]

I have a  similar  problem with an added  concern. 

Local  network 192.168.1.x

Remote  network 192.168.1.x

VPN  Works 

Split  tunnel  enabled 

When connected  via VPN , user can access remote  resources no issue.

Issues:

When connected  via VPN user  is  not able to print to printer  on  local  LAN  

When  connected  via VPN, user  is not able to change their  Active  Directory  password

[Toshi_Esumi]

No. The routing table is normal but you still should be able to reach IPs in the connected subnet. Otherwise you can't reach even the GW device 192.168.4.100 for the tunnel to work. The default routes are used only when more specific routes don't exist in the table. Something else seems to be wrong if you can't ping the local devices. I would suggest run Wireshark to see if the ping packets leave the PC or not. 

[bashrael]

With some help of fortinet support this problem is solved.

Config ip tunnel without split on your fortigate

Connect your forticlient and test if connection works.

backup your config in forticlient and edit the backup file

add following:

In the <ipsecvpn> section after </options> add these xml tags so it would with the xml file structure:  <connections>  <connection>  <ike_settings>  <enable_local_lan>1</enable_local_lan>  </ike_settings>  </connection>  </connections>  </ipsecvpn> 

save and restore this file in your forticlient.

Test again.  you can now access your local Lan.

grts

[pitamerica]

Hi, thank you. But i backup the file and searched for the strings you wrote. i can´t find it. The only thing i can find is the vpn config section like this :

edit "vpn1"        set type dynamic        set interface "wan1"        set xauthtype auto        set mode aggressive        set mode-cfg enable        set proposal 3des-sha1 aes128-sha1        set authusrgrp "Wizard_users"        set ipv4-start-ip 192.168.50.10        set ipv4-end-ip 192.168.50.40        set ipv4-netmask 255.255.255.0        set dns-mode auto        set ipv4-split-include „**********“        set psksecret ENC ****************

[przemo]

bashrael wrote about configuration file from FortiClient not from Fortigate.

[pitamerica]

Oh, thank you. Is this file local on the mac ? or where i can find it ?

[przemo]

I use only windows version. Run the FCT with administrator privileges -> File-> Settings-> Backup button -> save *.conf file. Edit this backup file and find section described by bashrael