Second LAN from VPN

[tomekw]

Hello all, I do not know how to set up a VPN connection for a second LAN.

On the LAN 10.6.0.0/16 I have a second LAN-2 10.16.42.0/24.

This network is accessed through a router with address 10.6.1.140.

On workstations that need to get to LAN2 I made entries in the routing table:

route –p add 10.16.42.0 mask 255.255.255.0 10.6.1.140

Route Print looks like this:

Network Address         Mask                 Gateway            Metric

10.16.42.0                 255.255.255.0    10.6.1.140         1

Ping to address: 10.16.42.205 is OK

At FortiGate80E (v5.6.2) i have configured user access via VPN SSL using FortiClient. LAN connection works.

How to configure FortiGate so that when connecting via VPN you also have access to LAN-2?

Regards

Tomek 

[Toshi_Esumi]

If you're using FortiClient SSL VPN, split-tunneling automatically injects the routes toward the tunnel so that they're split from the other destinations. You just need to include LAN-2 subnet for destination addresses (you probably want to use an address group) in the SSL VPN policy [ssl.root->LAN interface].

Then you need a static route for LAN-2 toward 10.16.1.140.

[tomekw]

Thank you, I will check your proposal. I set up in Static Routes: Dest: 10.16.42.0/32 Gate: 10.6.1.140 Interface: lan Should the CLI Console ping to the LAN2 address should match? Because it does not answer.

[Toshi_Esumi]

If the default route on the device you ping to is pointing toward your FG, yes, you should get responses. FG doesn't always pick the outgoing interface IP as a ping source. I almost always "exec ping-o source" to specify before "exec ping" unless I ping a directly connected IP.