Identity Awareness with AD not possible

[G_W_Albrecht]

Customer uses VPN with the GAiA cluster of the main site as center and SMB appliances (locally & SMP managed) on remote sites. As the SMBs also need to connect by VPN to a FortiGate, their external IPs have been removed from Encryption Domain using the Advanced Settings. This configuration was build with help of CP TAC and works as expected.

But now the customer wants to use IA for his users with an AD server at the main site - but IA packets use the external IP of the SMB and are not routed thru VPN to the main site, making the needed communication impossible.

Did anyone already encounter such an obstacle and found a way to resolve it ?

[Chris_Atkinson]

I recall another option in Advanced Settings that caters to similar.

Will share a screenshot accordingly, but applicability to central managed devices would need to be checked/confirmed with TAC perhaps.

"VPN site to site global settings - Use internal IP address for encrypted connections from local gateway."

[G_W_Albrecht]

This is locally managed and VPN site to site global settings are already used as advised by TAC:

"Do not encrypt connections originating from the local gateway" in VPN->Community resolved the Forti VPN issue and does disable "Use internal IP address for encrypted connections from local gateway" = TRUE automatically, so the ping from WebGUI thru the VPN tunnel does not work, only from CLI using ping -I <Local Address> it succeeds.

[AkosBakos]

Hi @G_W_Albrecht 

Maybe you are looking for this:

How to configure an alternate IP Address for Identity Awareness communication channel

Be careful before you change anything in the database. Save/backup everything 🙂

Akos

[G_W_Albrecht]

Thank you, forgot about that sk ! But it can not work - as written above, customer has SMB appliances (locally & SMP managed), so changing the SMS database does not help as the SMS only manages the main GAiA GW, but not the SMBs.

[AkosBakos]

Indeed, I always forget that, you have always tricky and detailed questions... and SMB-s 🙂

[G_W_Albrecht]

Remember - this is the SMB Gateways (Spark) board 😉 With GAiA this would be no issue at all as you could use the Encryption Domain per VPN Community feature and define different Communities for VPNs to CP and Forti. But that is impossible <yet with SMBs...

[Dafna]

Hi,

Can you please attach the topology?

Why did you exclude the external IP?

[G_W_Albrecht]

Customer has ca 73 SMBs locally Managed by SMP that each have a tunnel to a Fortigate (that is the reason why the external IP must be excluded (can send you a PM with SR# - this was configured by TAC)) and to the main Site GAiA cluster who sits in front of the AD.