Enable SSL VPN user to access remote site via IPsec tunnel

[JackieTF]

Hi all, i am a new fortigate user. I have two fortigate with model F300C(main) and F110D(branch). I created a policy based IPsec tunnel between them and it run just fine. After that, i try to create a SSL VPN access for the F300C device and allow user to access to it through SSL VPN . The question is how can i allow ssl vpn user to access to F110D site via the IPsec tunnnel created earlier? What policy should i add to allow ssl vpn user to access the remote site? Any advice/example would be greatly appreciated.Thanks.

[rwpatterson]

Welcome to the forums. To do what you want, the IPSec tunnel on the SSL VPN concentrator end needs to be configured in interface mode. Doing this will enable you to put a static route into the unit so that the SSL traffic can pass down the tunnel, as opposed to only the directly connected subnets.

[JackieTF]

Hi rwpatterson, Thanks for your quick reply. I am now more clear on how things work. It is a must to use route based VPN (interface mode) ? Any other alternative if i wan to use policy based VPN ? What static route i have to add to route ssl vpn traffic into the tunnel? Is it : destination = remote office internal segment, interface = tunnel interface for main office ? i assume no gateway is needed for this route as we point the traffics to tunnel interface directly ? Thanks again for pin point out a correct way to do things. Regards, Jackie ***************************************************************** Please bare with me as i am a newbie on firewall. My apologies if my question sounds too obvious for experts in this forum. Any advice will be greatly appreciated.

[rwpatterson]

Static route(s) to those remote subnets with the destination down the VPN(s) (Higher priority than the default = lower number or distance)

Static route back to the SSL VPN clients (should already be there)

Correct policies in place

Either add another phase 2 selector (if not all zeros), or mask the SSL VPN clients with an IP pool address from the LAN