VPN (FortiClient) through USB-WAN (FortiWiFi 60D-3G4G-VZW)

[DesterD]

I wanted to see if anyone else has tried the following; or at least see if this is possible.

I am setting up a FortiWiFi 60D-3G4G-VZW within a small office. WAN1 for Primary Internet access and the USB-WAN (Verizon Wireless SIM Chip) for a Failover. I have confirmed that both WAN1 and USB-WAN are configured correctly to allow LAN network to communicate outside. Is it possible to set up a FortiClient VPN that will connect through the USB-WAN if/when WAN1 is down.

I believe I have configured USB-WAN correctly by using the Fortinet cookbooks and using the VPN Wizard. For testing purposes, I allowed Ping, but when I try to ping the FortiWiFi gateway, I get no replies. When I try to connect through the FortiClient VPN, it will not connect.

Is it possibly that Verizon Wireless is blocking Ping, VPN, or any other outside-incoming requests because it is under a Cellular network?

[emnoc]

Most likely not.

Qs:

1>

Have you ran diag sniffer packet  <usbwan interface name>

2>

diag debug flow

3>

ensure that SSLVPN is listening on that interface

Ken

[DesterD]

Issue Resolved.

I do not know if Verizon blocks incoming requests when your account is set for DHCP IPs. When I purchased their Static IP package, I was able to ping from the outside and VPN into the network via the USB-WAN (VZW SIM chip). Here is what I did to resolve the issue.

1) Obtain a static IP from Verizon for the FortiWiFi.

2) Update the APN (Access Point Name) in FortiWiFi via CLI. The default APN (vzwinternet) will not work with static IPs. There are 5 APNs for static IPs depending on your region:

  ne01.vzwstatic (NorthEast)

  nw01.vzwstatic (NorthWest)

  so01.vzwstatic (South)

  mw01.vzwstatic (MidWest)

  we01.vzwstatic (West)

You may need to contact Verizon's technical support to confirm which APN you need to use or try each one until you get the one that works. Use the following commands to update your APN:

     Config sys lte-modem

     set apn we01.vzwstatic

     end

3) For the USB-WAN interface, keep the Addressing Mode to DHCP; do not use Manual. From a prior call to Fortinet Support, the Manual mode had issues and was removed as an option from FortiOS 5.4 and above. In FortiOS 5.2.x, this mode is still around. The FortiWiFi unit will pickup the static IP from Verizon. In a few minutes, the FortiWiFi unit will pick up the static IP and the USB-WAN is good to go; So as long as your Firewall Rules are good. I recommend enabling ICMP (Ping) for troubleshooting purposes and disabling it when done.

4) From here, follow the How-to guide for setting up the VPN.