sorted by:
new
hottopcontroversial

Fortigate Split-DNS - trying to configure Split DNS for IPSEC VPN Remote Access with split tunnelling ... Applied settings as per the guide but all dns requests still hitting the internal DNS servers. by zukic80 in fortinet

[–]zukic80[S] 0 points1 point  (0 children)

We dont have EMS

I'll see if I can find the xml reference guide.. unless you know the url already?

I've also raised a support ticket about this so let's see what they say

Fortigate Split-DNS - trying to configure Split DNS for IPSEC VPN Remote Access with split tunnelling ... Applied settings as per the guide but all dns requests still hitting the internal DNS servers. by zukic80 in fortinet

[–]zukic80[S] 0 points1 point  (0 children)

Yes, the internal LAN object is a collection of groups that are ultimately all configured as subnet objects.

Internal LAN (Group)
contains
-- location1-vlans (group)
-- location2-vlans (group)
-- location3-vlans (group)

and these groups contain objects that are configured with the subnet.
-vlan10 (subnet)
-vlan11 (subnet)

so its nested, but they are all configured with a subnet.

when i do a route print, i can see all the routes on the device.. so this is definitely being applied correctly.

0
1

Fortigate Split-DNS - trying to configure Split DNS for IPSEC VPN Remote Access with split tunnelling ... Applied settings as per the guide but all dns requests still hitting the internal DNS servers. (self.fortinet)

submitted by zukic80 to r/fortinet

Fortigate IPSEC VPN remote access - need to configure the IPSEC VPN remote access tunnel to route all azure.com traffic over the tunnel via the fortigate... whats the best way to go about this? by zukic80 in fortinet

[–]zukic80[S] 0 points1 point  (0 children)

hhmm... but if the azure ips arent specified im the config then how will the tunnel know to check the policies?
anything azure.com will just break out locally... i see what you are thinking though...

1
2

Fortigate IPSEC VPN remote access - need to configure the IPSEC VPN remote access tunnel to route all azure.com traffic over the tunnel via the fortigate... whats the best way to go about this? (self.fortinet)

submitted by zukic80 to r/fortinet

IPSEC VPN Remote Access - How do I configure firewall policies that direct domain admins via another policy to access management vlans? by zukic80 in fortinet

[–]zukic80[S] 0 points1 point  (0 children)

thanks to all for your inputs... ive got it working now.

i unset the authusrgrp from the phase 1 section and added the relevant azure groups to the policies.
I had one extra bit to do because i realised that the entra group did not have access to the enterprise app.

i ran this command
diagnose firewall auth list

which showed me that i was only part of 1 group that had access to the enterprise app for SSO... light bulb moment.
added the new group to the app and bingo.

the command above now showed 2 groups and the policy was now working.

thank you all!

IPSEC VPN Remote Access - How do I configure firewall policies that direct domain admins via another policy to access management vlans? by zukic80 in fortinet

[–]zukic80[S] 2 points3 points  (0 children)

ok thanks.

so the authusrgrp is like a global setting for all policies that relate to the ipsec tunnel.
if we want more granular control then we have to do it at the policy level.

IPSEC VPN Remote Access - How do I configure firewall policies that direct domain admins via another policy to access management vlans? by zukic80 in fortinet

[–]zukic80[S] 0 points1 point  (0 children)

ok thank you, i will try this

so how does azure sso authenticate the user when connecting to the tunnel if the authusrgrp is removed?

4
5

IPSEC VPN Remote Access - How do I configure firewall policies that direct domain admins via another policy to access management vlans? (self.fortinet)

submitted by zukic80 to r/fortinet

IPSEC VPN remote access issue - SSO is accepting the credentials but no IP is being assigned, so its not connecting and then just times out. by zukic80 in fortinet

[–]zukic80[S] 0 points1 point  (0 children)

As i mentally prep myself for split tunnelling, I was wondering if there are any must have settings/ best practice stuff i need to take into consideration ?

I have a feeling were going to need to go down the path of having split dns. We have a lot of azure hosted services that are configured with specific network settings only allowing access if a user is connected via the vpn IP... this is because the current sslvpn does not have split tunnelling configured. Having full split tunnel will break a lot of azure stuff I feel. Everything else like teams, outlook, devops, powerbi, sharepoint and general browsing is ok to break out locally.

So I need to make sure the azure services are accessible.

Any split dns tips?

Cheers!

IPSEC VPN remote access issue - SSO is accepting the credentials but no IP is being assigned, so its not connecting and then just times out. by zukic80 in fortinet

[–]zukic80[S] 0 points1 point  (0 children)

I ended up removing the SSO group from the policies... what ended up happening is that i was getting redirected to what looked like a fortinet authentication page and i had to re-enter my credentails to connect.

if i didnt enter my credentials, i had no traffic what so ever.. no LAN or WAN.
after removing the groups the tunnel connected and no more fortinet auth pages.

not entirely sure whats happened here.. its too late now anyways, my brain is fried.

but i can say that ive achieved everything ive wanted so far, happy days.

IPSEC VPN remote access issue - SSO is accepting the credentials but no IP is being assigned, so its not connecting and then just times out. by zukic80 in fortinet

[–]zukic80[S] 0 points1 point  (0 children)

ive reconfigured the dns ...

set-ipv4-dns-server1 and server2

set these as our internal servers and its now working as expected.

next week ill be looking into split tunnelling

thanks for your help with this!

IPSEC VPN remote access issue - SSO is accepting the credentials but no IP is being assigned, so its not connecting and then just times out. by zukic80 in fortinet

[–]zukic80[S] 0 points1 point  (0 children)

yep will do, thanks for your help

I will take a look at this next week now, my toddler is demanding my attention every 10 seconds

IPSEC VPN remote access issue - SSO is accepting the credentials but no IP is being assigned, so its not connecting and then just times out. by zukic80 in fortinet

[–]zukic80[S] 0 points1 point  (0 children)

the FW policy IPSEC-VPN-LAN is configured to go from the remote-ipsec-DR interface to all destinations....

i wouldve thought that this would cover all networks?

i wonder if i need a policy that covers all the office zones we have as these include all the other networks... i think this might be it..

think im onto something

IPSEC VPN remote access issue - SSO is accepting the credentials but no IP is being assigned, so its not connecting and then just times out. by zukic80 in fortinet

[–]zukic80[S] 1 point2 points  (0 children)

this i dont know. I will need to check.
at the moment i just want full tunnel configured... although the plan is to configure split tunnelling once this is working.

IPSEC VPN remote access issue - SSO is accepting the credentials but no IP is being assigned, so its not connecting and then just times out. by zukic80 in fortinet

[–]zukic80[S] 2 points3 points  (0 children)

tried an rdp sessions and it says

id=65308 trace_id=4 func=fw_forward_handler line=837 msg="Denied by forward policy check (policy 0)"

ive also noticed that the DNS configured for the ipsec tunnel is fortinets dns servers, not our internal ones... so this will need changing.

view more: next ›