VPN ssl Tunnel stopped working

[jesse_garcia]

Hi all, I'm new to Fortinet and this position. But last week we change our IP from our site to the county(I work at a school district). But I just noticed the VPN stopped working. I dont know where to start. Any give me any advice? I cant ping our gateway but not sure if that is normal, from inside? But the error we are getting is that the VPN server may be unavailable. Any help is greatly appreciated. 

[emnoc]

Explain what you mean by change ip? What I would do is point a browser at the fortigate and the new ip.v4 address and whatever port? Do you get a login screen ?

Next , can you ping the interface assuming ping is allowed?

if both of teh above fails, do a diag packet capture  diag debug packet <interface_name> 'port 8443' and test browser or fclient , do you see packets arriving and with the new sslvpn ip.v4 address?

Ken Felix

[jesse_garcia]

Sorry, We had to change our IP given to us from the county. Since we changed from Spectrum to Frontier. This is the WAN IP in the interfaces section of the Network Tab. We changed it there and the static ip to 0.0.0.0. Basically moved us from Spectrum to Frontier. From what i have been told, this just changed the gateway between us and the county's gateway. None of our public IP pools changed. 

No i do not get a login page when I point the address to the browser. That gives me the same error. the sit cannot be reached. 

Yes I can Ping the address though. 

Thanks for you help in this. 

[emnoc]

Not following you, but is the interface that your pinging protected by a uplink router? firewall?

Do you have any local-in policy that's attached?

Did you run "diag debug flow"

e.g

  diag debug reset 

  diag debug en

  diag debug flow filter addr 1.1.1.1 #< this would be your address of the sslvpn  interface

  diag debug flow trace start 30

Now run your fclient  to 1.1.1.1 or whatever ip address? Do you see traffic? if not, you have issues upstream , routing, filtering,etc.....

if you see traffic ,  than clear the above diag debug and debug sslvpnd

e.g

diag debug reset 

diag debug app sslvpnd -1 

And repeat the same test and follow the output and|or post it here.

Ken Felix

[jesse_garcia]

Thank you Ken. 

Our local in policies all reflect the same settings as it did before.

I will ask my county Rep about Router upstream and firewall. 

I have run diag debug and it seems like there is not traffic coming in. After running those commands and connecting my client via our outgoing  interface, there are no packets being received. 

Im guessing our ISP is not routing the to the new IP they assigned us as the way it was to the old one.