SSLVPN traffice gets filtered out

[Photogregor]

Hi,

on W7 computer I installed SSLVPN-Client (11.3.5), then I did SSLVPN-Configuration on the Firebox (x750e, 11.3.4), chose "Routed VPN Traffic" as it is determined by our customer and left all other settings as default. Client connects fine and user is authenticated by radius (SBS 2011) without problems. I can see the SSLVPN-connection details on the Firebox and ipconfig on the client shows 192.168.113.2 as IP address of TAP device. Setup of SSL VPN on Firebox created three roules, an any-rule ("Allow SSLVPN-Users") and two other rules called "WatchGuard SSLVPN" and "WatchGuard Authentication". So far everything seems to be ok.

But I cannot ping internal subnet (192.168.1.0/24). Even cannot ping 192.168.113.254, which is reported as Firebox-DHCP-Server by ipconfig. In Traffic Monitor I can see that traffic from client gets blocked. There seems to be missing another rule. I'm searching for a solution now for hours, could someone guide me into the right direction please?

Additional information: Clients IP address is 192.168.1.115, it is member of the SBS-2011-Domain.

Thanks and regards,
Stefano

 

[Photogregor]

No one, folks? Ok, I think it's difficult. Another information: When I try it in bridged mode everything works, I can ping, RDP and HTTP. But only if I set "Force all client traffic through tunnel". If I don't activate this option I have the same problems like in routed mode. Because of the fact that it works in bridged mode authentication problems can be excluded, I think.

It looks like there is a routing problem, like I have to add another rule. But which one?

Thanks a lot for any help,
Stefano

 

[smah]

The 3 policies sound correct. In addition to routed/bridged mode, my XTM device has an option to either:
Allow access to networks connected through Trusted, Optional, and VLAN's
or
Specify specific allowed resources
I would expect the x750e to have that option as well. If so, make sure it is set correctly.

You could always create a new policy for testing - one that allows SSLVPN user to access trusted and optional networks, but that shouldn't be needed.