Access FortiClient computer from LAN

[Bill_Daly]

I've successfully set up a VPN tunnel to allow FortiClients to connect to my FortiGate 90D (v5.2.5) and they can access all internal LAN addresses.  However, computers on the LAN are unable to ping the FortiClient computers.  When I do a traceroute from a LAN computer, the FortiGate seems to send the packets to its Internet interface instead of trough the VPN tunnel to the FortiClient.

The FortiClients can ping internal LAN computers, so the FortiGate knows the route to the FortiClient or else the FortiClient wouldn't be able to receive responses when they ping computers on the LAN.  The pings from the LAN to the FortiClients are not being blocked by any policy.

FortiClient VPN: 192.168.102.0/24

LAN: 192.168.2/24

config firewall policy
edit 1
set srcintf "Forticlient"
set dstintf "any"
set srcaddr "Forticlient_VPN"
set dstaddr "InternalNetwork"
set action accept
set schedule "always"
set service "ALL"
set nat enable
next
end

config router policy
edit 1
set input-device "internal"
set src "192.168.2.0/255.255.255.0"
set dst "192.168.102.0/255.255.255.0"
set output-device "Forticlient"
next
edit 2
set input-device "internal"
set gateway 70.46.74.1
set output-device "wan1"
next
end

config firewall address

edit "Forticlient_VPN"
set subnet 192.168.102.0 255.255.255.0
next

edit "InternalNetwork"
set subnet 192.168.2.0 255.255.255.0
next

end

I'm sure there's something stupid and obvious I'm missing, but I can't see what it is.

[localhost]

You are missing a policy in the opposite direction: from internal interface to the sslvpn interface.

Why are you using policy routes? Static routes would do the job as well, much easier to handle.

Also I see no reason to use NAT on policy 1.

[Bill_Daly]

It's an IPSec VPN, so there are no routes to the sslvpn interface.

A static route doesn't allow me to select the Fortinet VPN interface (although I can select the ssl.root interface).  I can only select site-to-site tunnels and physical interfaces.  I've tried creating static routes using the wan1 and internal interfaces, but that didn't seem to make a difference.

I use NAT because my LAN and VPN clients are on different subnets and I have no control over what addresses my VPN clients use when on other networks.  So, with NAT, my LAN is 192.168.2.0/24 and my VPN clients are 192.168.102.0/24.

[ede_pfau]

localhost is right, get rid of the policy routes. They are external to the regular routing and not necessary here: if the routing can be fully determined by the destination address then use regular routing. Only if not, then use PBR.

Second, using NAT will make it quite hard for you to ping a client. From the config posted I cannot see how the .102 network address is assigned to a client. Instead it would use the internal's IP address. As the NAT table is internal to the session (from client to local network) it can only route traffic back which belongs to the same session. A new session from LAN to client will have no clue where to look for the client.

A dial-in VPN will establish an ad-hoc route when connecting a client, you should be able to see it in the Routing monitor.

Having no control over the remote LAN's address space can be a problem (how to avoid a user having the same private address space on his LAN as on the local LAN?). If the number of users is small you could tell them which network address to use, and for your local LAN you will avoid the over-used 192.168.[0-2].0/24 addresses. Any of this is difficult in practice. The second workaround is to assign (non-overlapping) addresses to your clients via IPsec-DHCP. Then you will have full control over the addresses used.

I'm still not sure if you could ever initiate a session to a dial-in client, even with all the addressing settled. I don't think this type of VPN is meant to support it. I can't test that here as I only use s2s VPNs, or SSL-VPN for clients.

HTH.

[localhost]

I recreated your situation in my lab.

I was able to ping in both directions. Be aware that the Windows Firewall might block your pings!

You don't need any routes for the Dialup VPN. The Fortigate will create the routes to the VPN Clients on the fly.

Some snippets: port8=INTERNAL, port7=EXTERNAL

config user local
    edit "user1"
        set type password
        set passwd-time 2015-12-18 12:58:03
        set passwd ENC 5MvJfkLcI10iOWY6efs7Bt81I79ZUvZ4GY3EU28ztWyZbMzrrIRRAseH958w8KwDG9bJxD1hQrysGujJxV7e+vcgD8CxZC6toeTBPrdCEIe7u0hpwql/BGdqmFh2kXHfYQc3q1sKPKuVIQ/ZLaWbFgb9Sg4hGZNYH5M5E0FrVTQc1sW4XxYxaU969BwlW3Vb50PW8A==
    next
end
config user group
    edit "SSO_Guest_Users"
    next
    edit "Sample-Group"
        set member "user1"
    next
end

config vpn ipsec phase1-interface
    edit "Dialup"
        set type dynamic
        set interface "port7"
        set mode aggressive
        set mode-cfg enable
        set ipv4-dns-server1 8.8.8.8
        set comments "VPN: Dialup (Created by VPN wizard)"
        set xauthtype auto
        set authusrgrp "Sample-Group"
        set ipv4-start-ip 10.1.150.20
        set ipv4-end-ip 10.1.150.254
        set save-password enable
        set psksecret ENC dmFyL2V6MHFK6pWIBrRbJGIJDBF6cRSKkZFGbGlPuG+D5KeS5kSiauX+b2B6hpPawpQbsmalgV3PhLdCOcUJPWAv65+QnzYslHzg/PSeHI7tj2cx+fQtim/gdjTOnDpQZ2B6EAfU3UaAbw9p7+IbmY565MrM6LpJ9xbgXHu3gYsZdr8hDUyxk14gVUAF8sijuIglDw==
    next
end
config vpn ipsec phase2-interface
    edit "Dialup"
        set phase1name "Dialup"
        set comments "VPN: Dialup (Created by VPN wizard)"
    next
end

config firewall policy
    edit 1
        set uuid d6f13138-a57d-51e5-6bb8-ed0509419eda
        set srcintf "port8"
        set dstintf "port7"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set logtraffic all
        set nat enable
    next
    edit 2
        set uuid 1cfd13e0-a57e-51e5-6c76-e74f0ecebb03
        set srcintf "Dialup"
        set dstintf "port8"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set logtraffic all
        set comments "VPN: Dialup (Created by VPN wizard)"
    next
    edit 3
        set uuid e16a89a6-a57e-51e5-ef54-0ca90e1679ce
        set srcintf "port8"
        set dstintf "Dialup"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set logtraffic all
    next
    edit 4
        set uuid b0106758-a5b1-51e5-85da-6c7a583097ba
        set srcintf "Dialup"
        set dstintf "port7"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set logtraffic all
        set nat enable
    next
end