Thread Info
  • State Suggested Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 24 replies
  • Answers 1 answer
  • Subscribers 6 subscribers
  • Views 62640 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

VPN out UTM to corporate network issues.

ChadClement

I'm a home UTM user trying to VPN out to my corporate network. I'm able to connect, get an IP addresss and resolve hosts on the corporate network but when I try to get to their web pages i get nothing. I'm not seeing anything being blocked on the firewall rules nor should I as I'm not performing ssl inspection so I wouldn't see the traffic anyway. Any thoughts? I'm running the latest release.



This thread was automatically locked due to age.
Parents
  • 0

    Hi, Chad, and welcome to the UTM Community!

    Does #1 in Rulz give you any clues?  If not, my guess is a routing problem with the VPN endpoint at corporate.

    Cheers - Bob

    EDIT 2016-09-28: Added the link to Rulz.

  • 0 in reply to BAlfson

    Bob,

    Not sure what you mean by #1. My first rule is to allow any internal traffic outbound over any protocol. Not the most secure thing but did it for troubleshooting purposes.

    As far as a routing problem I'm the only one experiencing the problem. We're all a bunch of IT security consultants working remotely from home with our own individual FW solutions running on our home networks. 

    Once I took the UTM out of the equation and put a Linksys FW/Router in play everything worked fine.

    Using Pulse Secure as the vpn client.

    Thanks,

    Chad

  • 0 in reply to Tim Coyle

    I suspect that if it's the VPN client causing the problem, nothing you change in the UTM will make a difference.  You can confirm this by establishing the VPN from another network I.E. another person's house.  If you still can't browse the internet when the VPN is up you can blame the client.

  • 0 in reply to Shaun Raven

    Well before I installed the UTM I didn't have this problem.  I could have my VPN'd remote desktop up on one monitor, and then browse any standard non corpoarate site I wanted to on the other monitor.  The issue only started once I setup the UTM, so I was thinking there was something the UTM was doing that was blocking the traffic.  Even still, when I hotpot off my phone instead of my home wifi it runs normally... can browse The Google on one monitor and work my remote desktop on the other.  So that's why I was isolating the issue to a UTM setting.

  • 0 in reply to Tim Coyle

    Here's a wacky idea....

    Maybe UTM is seeing your web traffic as coming from the client end of the VPN tunnel.  For example, say your VPN tunnel is configured as a 10.100.x.x network - once the tunnel is established, your computer gets an address based on that tunnel.  If the web request is issued from that address, the UTM's web filtering may block it as it's not a recognized network.  Same may happen for DNS requests.

  • 0 in reply to Shaun Raven

    How can I see that?  I did ipconfig from the laptop, and I can see the LAN address and the VPN'd IP as well, but dont see either of those in the firewall or the web filter logs when trying to load lynda.com.

  • 0 in reply to Tim Coyle

    Tim, if you do route print at the PC's command line, is the Gateway for 0.0.0.0 your UTM or something at corporate?

    I suspect that it's time to do #1 in Rulz now that we know you're using FortiClient.

    Cheers - Bob

  • 0 in reply to BAlfson

    It is both.  0.0.0.0 has two entries, one for the UTM and one for corporate.

    Still not sure how to get what I want out of Rule 1, but then again I don't know much about this stuff anyways ;).  I just viewed Intrusion Prevention, Application Control and Firewall logs while trying to open www.google.com on the laptop, but the live logs didn't see to show new records as the site failed to load.

  • 0 in reply to Tim Coyle

    Have you looked in the Web Filtering log, Tim?

    Cheers - Bob

  • 0 in reply to BAlfson

    Yes, that is where I started but I see nothing with a familiar IP with respect to the laptop or the remote IP.  What should I look for, I am not very keen at parsing these when I do not see a source other than the computer I am using to watch the logs.

  • 0 in reply to Tim Coyle

    When you start a Live Log, put the client IP or the remote IP you're looking for into the 'Filter' box at the top and hit [enter].

    Cheers - Bob

  • 0 in reply to BAlfson

    Yeah, I did a find on the Web Filter Log for the past two days and the local IP does not show up.

Reply Children
No Data