Hot!Lost the outside connects when VPN-connect is up

Author
PIknik
New Member
  • Total Posts : 4
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/02/14 09:07:47
  • Status: offline
2018/02/14 09:08:58 (permalink)
0

Lost the outside connects when VPN-connect is up

Hello!
 
I have a FortiClient 5.6.5 on Windows 7 x64 and a connect parameters for IPSec VPN.
 
The VPN connect is work. But, when VPN-connect is up, I lost a connect with all my hosts on local network. The input (listening) connects to my host not work too. The Internet work is fine.
 
Now I can’t work with my computer without local resource and can’t install FortiClient on the server machine as the outside not have access to VPN-reaources.
 
My network when the VPN is not connected (host with VPN is 10.1.2.18):
 
Network Mask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.1.2.1 10.1.2.18 11
10.1.2.0 255.255.255.0 On-link 10.1.2.18 266
10.1.2.18 255.255.255.255 On-link 10.1.2.18 266
10.1.2.255 255.255.255.255 On-link 10.1.2.18 266
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.1.2.18 266
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.1.2.18 266
 
ping to Internet-resource - succesful
ping to 10.1.2.19 - succesful
 
nmap to this host of outside host:
$ nmap 10.1.2.18
 
Starting Nmap 7.40 ( https://nmap.org ) at 2018-02-14 19:00 MSK
Nmap scan report for 10.1.2.18
Host is up (0.0038s latency).
Not shown: 989 closed ports
PORT STATE SERVICE
135/tcp open msrpc
139/tcp open netbios-ssn
445/tcp open microsoft-ds
2522/tcp open windb
3306/tcp open mysql
3389/tcp open ms-wbt-server
49152/tcp open unknown
49153/tcp open unknown
49154/tcp open unknown
49155/tcp open unknown
49156/tcp open unknown
 
Nmap done: 1 IP address (1 host up) scanned in 1.62 seconds
 
 
My network when the VPN is connected:
0.0.0.0 0.0.0.0 10.1.2.1 10.1.2.18 11
0.0.0.0 0.0.0.0 192.168.121.2 192.168.121.1 2
10.1.2.0 255.255.255.0 On-link 10.1.2.18 266
10.1.2.18 255.255.255.255 On-link 10.1.2.18 266
10.1.2.255 255.255.255.255 On-link 10.1.2.18 266
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.121.1 255.255.255.255 On-link 192.168.121.1 257
100.100.100.100 255.255.255.255 10.1.2.1 10.1.2.18 10
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.1.2.18 266
224.0.0.0 240.0.0.0 On-link 192.168.121.1 257
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.1.2.18 266
255.255.255.255 255.255.255.255 On-link 192.168.121.1 257
 
ping to Internet-resource - succesful
ping to 10.1.2.19 - failed
 
nmap to this host of outside host:
$ nmap 10.1.2.18 -Pn
 
Starting Nmap 7.40 ( https://nmap.org ) at 2018-02-14 19:00 MSK
Nmap scan report for 10.1.2.18
Host is up.
All 1000 scanned ports on 10.1.2.18 are filtered
 
Nmap done: 1 IP address (1 host up) scanned in 201.27 seconds
 
I see a two default gateway, but my attempts fixed this is not succesful.
 
I have no idea who I can reduce security setting at VPN-connect is up. I need to have access to outside of my host and/or access to host of outside hosts.
 
I can’t have access to the VPN-server Forti. My tools is FortiClient only.
 
Can you help me?
#1

6 Replies Related Threads

    Hkp
    New Member
    • Total Posts : 11
    • Scores: 0
    • Reward points: 0
    • Joined: 2016/02/16 03:12:03
    • Status: offline
    Re: Lost the outside connects when VPN-connect is up 2018/02/15 00:09:33 (permalink)
    0
    Hi,
     
    if I understood your question correctly your devices in local subnet are not reachable when you are connected with FortiClient VPN?
     
    Are you using SSL or IPSec Dialup VPN? Should it be IPSec, change your Phase1 configuration in CLI:
     
    #config vpn ipsec phase1-interface
        edit "YOUR-PHASE1-VPN-TUNNEL-NAME" (upper and lower cases must be correctly!)
             set include-local-lan enable
        next
    end
     
    #2
    PIknik
    New Member
    • Total Posts : 4
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/02/14 09:07:47
    • Status: offline
    Re: Lost the outside connects when VPN-connect is up 2018/02/15 06:39:37 (permalink)
    0
    Yes, you understood is right.
     
    I use IPSec VPN. How I can to connect to CLI in the FortiClient?
    #3
    Hkp
    New Member
    • Total Posts : 11
    • Scores: 0
    • Reward points: 0
    • Joined: 2016/02/16 03:12:03
    • Status: offline
    Re: Lost the outside connects when VPN-connect is up 2018/02/15 23:16:33 (permalink)
    0
    You have to connect to your Fortigate via CLI like PuTTY. 
     
    FortiClient don't need any changes :) 
    #4
    PIknik
    New Member
    • Total Posts : 4
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/02/14 09:07:47
    • Status: offline
    Re: Lost the outside connects when VPN-connect is up 2018/02/16 02:13:46 (permalink)
    0
    I have not access to Fortigate.
    I have only a downloaded Forticlient programm and IP-address of VPN-server with login/password. This is all.
    #5
    ede_pfau
    Expert Member
    • Total Posts : 5624
    • Scores: 380
    • Reward points: 0
    • Joined: 2004/03/09 01:20:18
    • Location: Heidelberg, Germany
    • Status: offline
    Re: Lost the outside connects when VPN-connect is up 2018/02/17 05:21:15 (permalink)
    5 (1)
    Actually, there is a setting locally in the FortiClient config...but I cannot guarantee that this setting will be effective. It might well be that the VPN server's setting will override it (at least that would make sense).
     
    So, in FC, use
    'File' menu, 'settings'
    'System', 'back up complete configuration'
     
    This will export the FC config as an XML file (editable with any text editor).
    Look for
    <vpn>
       <ipsecvpn>
          <connections>
             <connection>
             ...
             <enable_local_lan>1</enable_local_lan>
     
    If the setting is '0' instead, change it to '1'. If the line doesn't exist, add it.
     
    Then, save the file and restore it to FC.
    Shut down FC, restart it and test.
     
                   

    Ede

    " Kernel panic: Aiee, killing interrupt handler!"
    #6
    PIknik
    New Member
    • Total Posts : 4
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/02/14 09:07:47
    • Status: offline
    Re: Lost the outside connects when VPN-connect is up 2018/02/20 08:00:30 (permalink)
    0
    Yes! This is work!
     
    I to edit cfg-file how you said and now I can to connect to other hosts in subnet (but can't to connect to hosts in other subnet, but it's fine for me)
     
    Work ping, telnet, ssh, etc
     
    Thanks you very match! And sorry for my bad English)
    #7
    Jump to:
    © 2018 APG vNext Commercial Version 5.5