vpn connection successful - file sharing works, but no remote dekstop, ssl or ping from outside net.

[#1]

Hi Everybody, hope that somebody can help me with this problem. Intro I' ve managed to set up a ipsec vpn conection following the example given by fortinet " dial-up vpn example" - except for the " set single-source enable" the entire configuration match the one given by fortinet. i have defined no other rules, for inbound traffic og outbound traffic. the reason for not typing the " set single-source" is that the firmware is old, and i cant find a ftp server where i can download the new firmware. THE PROBLEM I' m able to use windows filesharing with my vpn, but i' m unable to use remote desktop (microsoft), or connect to a machine on the internal lan using ssh. I' m able to ping the external client from with in the network, but i' m unable to ping the internal servers, from the external client. if i do a tracert i command prompht i get to the firewall, and then the rest of the time it just shows stars, as if i' m unable to get through the firewall. Please help Any comments are welcome, on how to solve the problem or direction to where i might download the new firmware. kind Regards Carl

[#2]

Perhaps too obvious... but does the fw rule allow a tunnel in both ways? Regards, Eric

[#3]

The firewall policy is set to Adress: all Destination: All Schedule: always Service: Any Action: Encrypt VPNTunnel: " blabla" Allow inbound Allow outbound Inbound Nat Protection Profile: Strict so i guess this means that both ways are allowed. Kind Regards Carl

[#4]

hello, try to disable the " inbound NAT" . maybe that' s the problem. regards andy

[#5]

Disabled inbound nat, no difference, everything still works as before, filesharing ok, but no ping, sll or remote desktop. could it be something with the firmware of the firewall, or is something to do with the way remote desktop works?

[#6]

hello, what about a traceroute? at which place does it end? the firewall on the PC allows you to ping? regards andy

[#7]

I did a trace route from the client, and it stops at the ip address of the external interface, of the firewall, using debug on the firewall i' m able to see that the firewall picks up something, but i don' t know what it means. Kind Regards Carl

[freaky]

Sounds to me like you have only the Filesharing opened on the windows firewalls on the clients. As you can share files, it severely limits the number of places where it can go wrong. IP traffic is fine, so it' s 99.9% a firewall that stops you. Probably the one on the clients.

[#9]

i have tried to disable the firewall on a client on the lan, but i' m still unable to access the client. if i log into the FortiGate firewall and enter: diagnose debug enable diagnose debug console timestamp enable diagnose debug application ike 2 i' m able to se some kind of trafic when i ping a client on the internal lan from the external klient. but when i use remote desktop i' m unable to see any kind of traffic, does the remote desktop travel along some other kind of route? fx the internet instead of the vpn tunnel. kind regards Carl

[#10]

in the forticlient i have set up virtual ip acquisition like this IP: 192.168.2.130 SUB: 255.255.255.128 DNS: 192.168.2.6 WINS: 192.168.2.6 i should use the dns server of my regular lan right? or should it be set to the ip of the external interface? another thing which seems wierd to me is that if i do a ipconfig /all on a client after the vpn connection has been established. the result is: IP: 192.168.2.130 SUB: 255.255.255.128 Def Gateway : DHCP: 192.168.2.131 DNS: 192.168.2.6 WINS: 192.168.2.6 Shouldn' t there be a default gateway, and what about dhcp, I haven' t set any dhcp server up on that ip. Don' t know if this info helps in any way. Kind regards Carl