When a user VPN into a Fortigate Router , make sure they can access all Subnet available to the router not just the local one :
- Added security policy – allow from SSL VPN interface to IPsec VPN
Name : SSL VPN to New Subnet
Incoming Interface : SSL-VPN tunnlel Interface ( ssl.root )
Outgoing Interface – %Interface of Site to Site VPN for Remote Site%
Source : SSL VPN Client Range / SSLVPN_Users
Destination Address : %new subnet%
Schedule : Always
Service : ALl
Action : Accept
Nat : Enabled ( to traverse IPsec VPN as local address (192.168.0.x) as opposed to SSL VPN client range (192.168.1.x)
IP Pool Configuration : Use Dymanic IP Pool and NAT Pool for SSL VPN Clients
2. Make you have DHCP NAT pool Range excluded from your onsite DHCP
3.Added New Subnet to routing address in SSL VPN portal – tunnel mode
VPN – > SSL VPN Portals
Tunnel Mode -> Enable Split Tunnelings -> Routing Address
Loading...