VPN connection through Second Internet Exit

[jadeltoro]

Hi.

I wanted to ask you about the following problem I am encountering:
I have a Fortigate 80E device with one of the internet outputs via fiber (Wan1). The second is WiMax and it is what we use to give our company's clients free Wifi (Wan2). To access this internet we use an access point connected to port 11 lan.

At the same time, we have enabled the VPN connection to the Fortigate through the public IP and a port. If we connect a laptop from which we share the mobile phone's Wi-Fi, we have no problem accessing the VPN, but if we try to use the free internal Wi-Fi internet, access is impossible.

The questions are the following: Is it viable to connect via internal open Wi-Fi to the VPN?
If so, what additional policies or configuration would we need to create in Fortigate to make this possible?
I am waiting for a response. Thanks in advance. All the best. Thank you.

[pgautam]

Hi @jadeltoro 

Thank you for updating your query.

If I understood you correctly you would like to connect to the SSL VPN when accessing the internet via access-point on the device(Please correct me If I am wrong on this point)

For connecting to the SSL VPN firewall IP where the SSL VPN is configured should be reachable for the AP(access-point users). 

Please check the below links if this can help you:-

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-enable-SSL-VPN-Access-for-two-diffe...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Enabling-the-preserve-session-route/ta-p/1...

Regards

Priyanka

[jadeltoro]

Hi @pgautam 

First of all, thank you for your response.

I think I didn't explain myself well.

I do not want to create 2 independent VPN accesses (understood as such, one for each internet wan and its corresponding public IP).

My interest is in maintaining a single VPN access (a single public IP and port, configured through wan1 with fiber internet), and also being able to access it from my other internal subnet that is created when the devices connect via Wi-Fi.

That is, access from wan2 to wan1.

A greeting.

[jadeltoro · Accepted solution]

Hi again.

I have already solved my problem. It was just a firewall policy in which I set my access point as the incoming interface and wan2 as the outgoing interface.

Thanks and sorry for the inconvenience.

[hbac]

Hi @jadeltoro,

I believe you want to connect to the SSLVPN from the wifi network behind port11? Which IP address are you using to connect to the VPN? Is it the public IP of wan1 or wan2? We need to run debug flows to get more details: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-First-steps-to-troubleshoot-connecti...

Regards, 

[jadeltoro]

Hi @hbac , thank you for your response.

The public IP that we use for VPN access is wan1 (fiber internet).

In Wan2 we go out through WiMax and internally we have an access point connected to port11. We would like to be able to access the VPN created on wan1 from the internal subnet that is created when the devices connect via Wi-Fi.

That is, access from wan2 to wan1.

Sorry for my limited knowledge of running debugging flows, since I've only been using Fortigate for a few days. I don't see myself, at the moment, capable.
It is also not possible for me to monitor every attempt I make to connect to the VPN from port 11 that has output through wan2 in the logs section of fortigate. Is there a way to activate this somewhere to be able to view the attempts and possible errors at a basic level?

A greeting.

[jadeltoro]

Hi again.

I have already solved my problem. It was just a firewall policy in which I set my access point as the incoming interface and wan2 as the outgoing interface.

Thanks and sorry for the inconvenience.