subnet mask problem with ssl tunnel VPN

[#1]

The tunnel VPN almost worked the way I wanted it to. It picked up one of the reserved IP addresses, but the subnet mask was 255.255.255.255 instead of 255.255.255.0. I set up the destination network with a subnet mask of 255.255.255.0 so I don' t know why it used the other subnet mask. Does it matter what interface I set the network to.? Right now I have it set to ANY.

[rwpatterson]

No, they are two separate entry paths. I only asked because in one of your previous posts, you had mentioned IPSec. From my home (where I am now), i just popped into my SSL VPN connection. Below is a display of the output:

C:\Documents and Settings\localuser>ipconfig /all
 
 Windows 2000 IP Configuration
 
         Host Name . . . . . . . . . . . . : p4-2800mhz
         Primary DNS Suffix  . . . . . . . :
         Node Type . . . . . . . . . . . . : Hybrid
         IP Routing Enabled. . . . . . . . : No
         WINS Proxy Enabled. . . . . . . . : No
         DNS Suffix Search List. . . . . . : servers.xxx.yyy
                                             xxxxxxxxx.local
 
 PPP adapter fortissl:
 
         Connection-specific DNS Suffix  . : servers.xxx.yyy
         Description . . . . . . . . . . . : WAN (PPP/SLIP) Interface
         Physical Address. . . . . . . . . : 00-53-45-00-00-00
         DHCP Enabled. . . . . . . . . . . : No
         IP Address. . . . . . . . . . . . : 172.18.20.11
         Subnet Mask . . . . . . . . . . . : 255.255.255.255
         Default Gateway . . . . . . . . . : 172.18.20.11
         DNS Servers . . . . . . . . . . . : 150.120.100.100
                                             172.16.0.3
         Primary WINS Server . . . . . . . : 150.120.1.33
         Secondary WINS Server . . . . . . : 150.121.1.7
 
 Ethernet adapter 192.168.39.28:
 
         Connection-specific DNS Suffix  . : xxxxxxxxx.local
         Description . . . . . . . . . . . : DAVICOM 9102/A PCI Fast Ethernet Adapter
         Physical Address. . . . . . . . . : 00-50-2C-07-AE-72
         DHCP Enabled. . . . . . . . . . . : Yes
         Autoconfiguration Enabled . . . . : Yes
         IP Address. . . . . . . . . . . . : 192.168.39.28
         Subnet Mask . . . . . . . . . . . : 255.255.255.0
         Default Gateway . . . . . . . . . : 192.168.39.60
         DHCP Server . . . . . . . . . . . : 192.168.39.100
         DNS Servers . . . . . . . . . . . : 192.168.39.100
                                             192.168.39.60
         Lease Obtained. . . . . . . . . . : Sunday, December 30, 2007 23:43:53
         Lease Expires . . . . . . . . . . : Wednesday, February 13, 2008 23:43:53
 
 C:\Documents and Settings\localuser>

From here, you can see that although the subnet mask is 255.255.255.255 and the gateway is the PC itself, this is how the system works. For routing purposes, the FGT knows the subnet mask is 255.255.255.0, and will route the traffic accordingly. I am able to get anywhere behind my firewall that I need to (that my policy permits) without any problems. If you are just unhappy with the way it appears, then you' re going to have a long unhappy road trying to get it ' fixed' . This behavior is quite normal. If you are having problems, look elsewhere...

[#3]

No, I' m not unhappy with the way it works; I' m just trying to get it to work. OK, so the the subnet mask is 255.255.255.255 and the default gateway is the same as the computer' s IP address. I now know that that is how it' s supposed to be. Now I' m just trying to figure out why I can' t ping any servers through the command prompt and why I can' t map any drives.

[#4]

For an SSL VPN, does the DHCP server need to be IPSEC or regular? Does the Server Certificate need to be self-signed or Fortinet_Local?

[rwpatterson]

For SSL VPN, DHCP is not required. In the user group area (if using tunnel mode), configure the IP address range under ' Advanced.' Any certificate works as well. I use whatever Fortinet provided with the box, and have no problems.

[#6]

I hired a consultant from a Fortinet partner and he configured the SSL VPN the same way I did. The same result: It connects, when I go to the command prompt, I can' t ping anything. I also can' t map any drives in My Computer. I was using a local user created on the Fortigate and not LDAP authentication. Does anybody have step-by-step instructions for setting this up? I used the book I got from my Fortigate class, I' ve used the instructions in the Knowledge Center, but I still can' t get this to work. I' m missing something, somewhere.

[#7]

I think I might have found a solution from rwpatterson on this post: http://support.fortinet.com/forum/tm.asp?m=36864&p=1&tmode=1&smode=1 " 3) Create the route to point return traffic back to the ssl.root interface Destination IP/Mask: (the subnet in the ' SSL-VPN User Group Options - IP range' area in the user group) Device: ssl.root Gateway (grayed out) Distance: 2 (pick a reasonable number)" For some reason it had a completely different network (I don' t even remember entering anything into Router, Static. Do I enter a specific IP/Subnet Mask on that network or do I enter the NetworkID/Subnetmask?

[rwpatterson]

You can do either. If you want to go through the one-for-one approach, then each time you create a tunnel, you will have to create the route back (yechh). I make sure all my User Group tunnel ranges are on the same class C subnet, and have created a single route back.

[#9]

OK, now I' m getting somewhere. I added the static route and now I can ping (yeah!) BUT... I can only ping by IP address and not by name (I have the DNS and WINS configured so I don' t know why). And I still cannot access any folders, either through Run \\server\share or by mapping a drive through My Computer. Once I can map drives we can finally be done with this thread.

[rwpatterson]

I have that same problem. Since we do not use compliant addresses inside our firewall, the only way around this issue would be to turn off split tunneling. Also on each FortiSSL adapter, you have to manually add the DNS domain suffix. Each machine has to be visited (or in the least have a registry script run) to have the correct suffix added so that you can then resolve those servers.

[darrell]

Can the machine you are trying to ping from your client route to you? If you do a traceroute from the machine you are trying to ping, does it hit the firewall to which you are connected?