no connection to any host except appliance itself after client is connected

[adrian]

Hi,

I am currently in trial mode and trying to figure things out. I can connect to the vpn fine, client certificates work, active directory works. Yes I've already read a few posts here on this forum, but nothing worked.

However the only ip i can "access" when connected is 10.200.200.200 (the standard vpn base ip). I get no incoming pakets except when pinging that ip.

I already allowed *:* in the ACLs hoping that it would help. The underlying OS is Windows 11 (up2date) using client version 9.1R14 (I couldnt find R15 anywhere to download). In my router I already set up a rule for my clients network (10.2.0.0/16) to be routed via the appliances internal ip (192.168.100.x). The external network is on 192.168.98.x.

I seem to miss something completely here as it was not hard to configure an OpenVPN and/or Strongswan server (IKEv2) at all. I do like Pulse Secure and the options it has - but why the heck wont it work?

Any ideas to what I am missing?

Any help is appreciated!

[zanyterp]

if you are on a cloud appliance, you will need to enable sNAT at System>Network>VPN Tunneling
do you have split tunneling enabled or disabled?
if it is enabled, have you added your corporate network at Users>Resource Policies>VPN Tunneling>Split Tunneling Networks?

[adrian · Accepted solution]

Hi,

I've installed the appliance on a VMware Esxi host which is behind our firewall.

I've forwarded ports 80,443/tcp and 500,4500/udp to the external ip of the machine.

Split tunneling is disabled in the settings, but I guess it's worth a shot trying it the other way around. I'll report back whether or not that was the solution when I get back to the system.

[zanyterp]

thank you 🙏
when you are on the vpn from outside the network, can you complete a traceroute from a computer inside the network to your vpn ip? if yes, where does it get dropped?

[adrian]

Hi @zanyterp ,

thanks again very much for your help.

I dont know what exactly did the trick, but switching back and forth the "split tunneling mode" and in the progress providing the corporate networks seems to have done "something".

It's actually working now.

Thus I can finally finish all configs (autologin etc) on my test machine.

[zanyterp]

you are welcome; glad you were able to find a way to work it successfully