VPN Connects Successfully but Remote Computers Are Unreachable
Asked by
MellowCedar42
After installing a new FortiGate firewall, some users can establish the VPN connection but cannot ping or access their assigned work computers. Testing from the affected PCs shows that traffic to the remote work device does not get through. The users' local home networks use the same subnet as the office network, which seems like the likely cause. However, one test from another home network using that same subnet worked normally, so it is unclear whether the overlap is the entire problem. The VPN assigns clients addresses from a 10.0.0.x pool, and the tunnel is configured as full tunnel. What should be checked next?
Answers
Since this is a FortiGate and the tunnel is full tunnel, review the firewall policies and run a flow trace while reproducing the problem. A traceroute timing out alone does not identify whether the issue is routing, policy, or return traffic. Also verify the VPN type, source and destination interfaces, firewall rules, and whether the remote computer's own firewall allows traffic from the VPN pool. MTU is worth checking too, but subnet overlap and routing are the stronger suspects.
Reply to this answer
Make sure the VPN address pool and routing are configured separately from both the office LAN and the clients' local networks. A dedicated VPN subnet is still necessary, but it will not fully solve a conflict when the user's local LAN overlaps the destination subnet. Check the client route table while connected and confirm that traffic for the work subnet is being sent through the tunnel.
Reply to this answer
The first thing to investigate is overlapping LAN ranges. If a user's home router and the office use the same subnet, the computer will usually try to reach the work device locally instead of sending that traffic through the VPN. The cleanest long-term fix is to renumber the office network to a less common private range, although that can be a major project. Changing the affected home networks may be a practical short-term workaround.
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions