route webportal traffic over ipsec tunnel possible?

[Ralph1973]

Hello,

I run fortios 5.2 with a customer and I 've setup a webvpn portal for remote access to 2 rdp servers. One runs local, one runs on the other end of a ipsec s2s vpn tunnel. They cannot reach the rdp server on the other site of the tunnel.

When sniffing the traffic, you can see that the public ip is used to reach the other site. This would mean I have to add this in the phase 2 selectors of the ipsec tunnel, but maybe there's another way?

Kind regards,

Ralph Willemsen

[emnoc]

So they want to use  SSLVPN over a IPSEC tunnel? Is that correct?

Is the ipsec vpn site2site or dialup client ?

[Ralph1973]

Hello and thank you for your response.

This is the traffic:

browser to sslvpn portal of the Fortigate, then click a bookmark to an rdp server

That rdp server lives on the other end of an ipsec site 2 site vpn.

I noticed that when you click the link, the connection is tried to be established from the wan ip of the Fortigate, the same ip from which the site 2 site tunnel is built up.

Regards,

Ralph

[Carl_Wallmark]

Hi Ralph,

I think you need to create a VIP on an interface which will point to the RDP on the other side.

Then you use your webportal RDP IP to point at the VIP.

[Ralph1973]

Hello, unfortunately this doesn't work. I can only enter an ip adress they connect to. If I make a vip for this ip, with the real ip to translate to, you also need to create a policy. But what policy needs to be created to be hit.

From wan1 interface ip to the tunnel interface and then snat to an ip that is allowed on the tunnel. But this doesn't work...

Ralph

[emnoc]

I think it's easier than that. You probably have 2 options

1:  SNAT the SSLvpn assigned networks out the  site2site vpn interface ( please say you did a route-based vpn )

or

2: carry the SSLvpn dynamic route assigned block as another  phase2-interface and install a route on the remote-firewall to reach this block

 btw the above would be if the client was tunnel-mode, if you want the webvpn firewall to access the RDP server, run a diag debug flow to see what address is being used on local firewall for making the access and change the settings in the above sample to match.

Pls let us know what you run into. I'm have done turn around SSLVPN rules to allow SSLVPN clients back out and I'm sure you can probably do what you want for the webvpn portal also.

e.g

near-far where SSLVPN terminates;

config vpn ipsec phase2-int

  edit "LAN2LAN-p2"         set auto-negotiate enable         set keepalive enable         set keylife-type both         set pfs disable         set phase1name "LAN2LAN"         set proposal 3des-sha1 aes128-sha1         set replay disable         set dst-subnet 172.17.12.0 255.255.255.0  <- RDP server network at the other end of the vpn         set keylifekbs 400000         set keylifeseconds 3600         set src-subnet 10.214.123.0 255.255.255.0 <----network of the SSLVPN clients     next

far-end where RDP network terminates

config vpn ipsec phase2-int

  edit "FAREND-p2"         set auto-negotiate enable         set keepalive enable         set keylife-type both         set pfs disable         set phase1name "FARENDLAN2LAN"         set proposal 3des-sha1 aes128-sha1         set replay disable         set src-subnet 172.17.12.0 255.255.255.0  <- RDP server network at the other end of the vpn         set keylifekbs 400000         set keylifeseconds 3600         set dst-subnet 10.214.123.0 255.255.255.0 <----network of the SSLVPN clients     next

And a route installed to reach the ssl vpnpool;

config router static

   edit 888

      set dev FARENDLAN2LAN

      set dest 10.214.123.0/24

end

And lastly you need a policy for the traffic;

config firewall policy

    edit 0         set srcintf "ssl.root"         set dstintf "LAN2LAN"             set srcaddr "SSLVPNPOOOLSRC"                          set dstaddr "RTNETWORK@RDPSERVERLOCTAION"                      set action accept         set schedule "always"             set service "RDP" 

            set comment " to allow traffic across the  vpn from the SSL vpn range/network "

end

Lastly diag debug flow is your friend.

[Carl_Wallmark]

emnoc, I dont think he is using tunnel mode in SSL, only webportal. Then you won´t be assigned an IP.

Ralph: Try this

Create a policy

ssl.root -> internal

Create a VIP on internal with lets say 192.168.1.1 (whatever you have) and port 3389 point that one to x.x.x.x (remote side RDP server)

Then create a RDP bookmark pointing to 192.168.1.1

If you dont have a policy with Internal -> "other side" with port 3389 you will probably need that one too.

[emnoc]

I figured out he was using webportal mode after I had started the reply, but I like to see if that would work with the webvpn access. He still should run diag debug flow to see what's the flow.

Even in  webvpn-portal the connections comes from the fortigate directly, so I believe he can do it with just that and no vip. He's just need to check what interface add address is being used ensure it's allow in the vpn phase2 SAs.

Ken