Configuring SSL VPN in Fortigate

SSL VPN using web and tunnel mode

In this example, you will allow remote users to access the corporate network using an SSL VPN, connecting via web mode using a web browser or tunneling using FortiClient. Web mode allows users to access network resources, such as the AdminPC used in this example.

SSL VPN web tunnel mode 768
Configuring SSL VPN in Fortigate 6

For users connecting via tunnel mode, traffic to the Internet will also flow through FortiGate, to apply security scanning to that traffic.

During the connection phase, the FortiGate it will also check that the remote user's antivirus software is installed and updated. This recipe is in the FortiGate Basic network collection. You can also use it as an independent recipe.

How to Create VPN

Editing the SSL VPN portal

  1. To edit the full access SSL VPN portal, go to VPN> SSL-VPN portals. The full access portal allows the use of tunnel mode and web mode.
  2. In Tunnel Mode, disable Enable split tunnel for IPv4 and IPv6 traffic to ensure that all Internet traffic passes through FortiGate.
  3. Define source IP pools to use the default IP range SSLVPN_TUNNEL_ADDR1.
Fortinet SSL VPN tela2
Configuring SSL VPN in Fortigate 7

In Enable web mode, create predefined bookmarks for any internal resources that VPN users need to access. In the example, the marker allows the remote user RDP access to a computer on the internal network.

SSL VPN Users
Configuring SSL VPN in Fortigate 8

Configuring the SSL VPN tunnel

  1. To configure the SSL VPN tunnel, go to VPN> SSL-VPN Settings.
  2. Set Listen on the interface (s) to wan1. To avoid port conflicts, set Listen on port to 10443.
  3. Set Restrict access to allow access from any host
    Optionally, set Restrict Access to Limit access to specific hosts and specify the addresses of the hosts that are allowed to connect to this VPN.
  4. In the example, the Fortinet_Factory certificate is used as the server certificate. To ensure that the traffic is secure, you must use your own CA-signed certificate. For more information about using certificates, see Avoiding certificate warnings (certificates signed by CA).
  5. In Client settings in tunnel mode, set IP ranges to use the default IP range SSLVPN_TUNNEL-ADDR1.
Screen Shot 2020 11 17 at 11.18.03
Configuring SSL VPN in Fortigate 9
Screen Shot 2020 11 17 at 11.18.25
Configuring SSL VPN in Fortigate 10

Doubts? Talk to our experts

Read the full material at: https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/690301/configuring-the-ssl-vpn-tunnel

EN
Scroll to Top