Stackvora.tech

FortiGate SSL VPN Setup

Detailed guide to setting up FortiGate SSL VPN for secure remote access, covering interface configuration, user authentication, portal customization, and firewall policies.

FortiGate SSL VPN provides a secure, encrypted tunnel for remote users to access internal network resources. Unlike IPsec VPN, which often requires specific client software and can be challenging with NAT traversal, SSL VPN typically uses a standard web browser or a lightweight client, making it highly flexible and user-friendly. This guide details the configuration steps for establishing a robust SSL VPN solution on FortiGate firewalls.

Initial Configuration: Interface, Port, and IP Ranges

The foundation of a FortiGate SSL VPN involves defining where the VPN service listens and what IP addresses it assigns to connected clients.

Defining Listening Interface and Port

The SSL VPN service must listen on an external interface, typically a WAN interface, to be accessible from the internet. A non-standard port is often used to mitigate basic port scanning and brute-force attempts.

config vpn ssl web portal
    edit "full-access"
        set tunnel-mode enable
        set web-mode enable
    next
end

config vpn ssl settings
    set servercert "Fortinet_Factory"
    set sslv3-tls1-0 disable
    set sslv3-tls1-1 disable
    set sslv3-tls1-2 enable
    set screen-gui enable
    set reqclientcert disable
    set default-portal "full-access"
    set source-interface "wan1"  <!-- Specifies the interface the SSL VPN listens on -->
    set listen-port 10443 <!-- Custom listening port for SSL VPN -->
    set ip-pools "SSLVPN_Tunnel_Addresses"
    set tunnel-connect-without-utun-client disable
    set dtls-tunnel enable
    set dtls-psk 0xXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX <!-- DTLS PSK (optional) -->
end

In this example, the SSL VPN listens on wan1 using TCP port 10443. It's recommended to replace "Fortinet_Factory" with a proper publicly signed certificate if available. The sslv3-tls1-0 and sslv3-tls1-1 disablements enforce stronger TLS protocols (TLS 1.2 is enabled by default in recent FortiOS versions like 7.0+). The default-portal is set to "full-access", which we'll configure later.

Configuring Tunnel Mode IP Range

For tunnel mode, FortiGate assigns an IP address from a defined pool to each connected SSL VPN client. This pool should be a unique subnet not used elsewhere in your network.

config firewall address
    edit "SSLVPN_Tunnel_Addresses"
        set type iprange
        set start-ip 10.212.134.200
        set end-ip 10.212.134.210
    next
end

This creates an IP address range from 10.212.134.200 to 10.212.134.210, providing 11 available IP addresses for SSL VPN clients. For FortiOS 6.4+, you can also define these as a firewall central-nat-pool.

User Authentication and Authorization

Secure access requires robust user authentication. FortiGate supports local users, RADIUS, LDAP, TACACS+, and SAML.

Creating SSL VPN User Groups

It's best practice to group users for easier management and policy enforcement.

config user group
    edit "SSLVPN_Users"
        set member "john.doe" "jane.smith"
    next
end

This example assumes local users john.doe and jane.smith already exist. For larger deployments, integrating with an external authentication source like LDAP or RADIUS is more scalable.

Local User Configuration Example (Optional)

config user local
    edit "john.doe"
        set type password
        set passwd "SecureP@ssw0rd!"
        set two-factor fortitoken
        set fortitoken "FTKMOBXXXXXXXXXXXXXXXX"
        set email-to "john.doe@example.com"
    next
    edit "jane.smith"
        set type password
        set passwd "AnotherS3curePwd!"
    next
end

Using two-factor authentication (e.g., FortiToken, email, SMS) is highly recommended for SSL VPN users.

SSL VPN Portal Configuration

The SSL VPN portal defines the resources and access methods available to users once they connect.

Configuring the 'full-access' Portal

A common setup involves a portal that enables both tunnel mode (for full network access) and web mode (for specific web-based applications).

config vpn ssl web portal
    edit "full-access"
        set tunnel-mode enable
        set web-mode enable
        set ip-pools "SSLVPN_Tunnel_Addresses"
        set auto-connect-client enable
        set allow-client-rdesktop enable
        set allow-client-smb enable
        set allow-client-ftp enable
        set allow-client-ssh enable
        set allow-client-telnet enable
        set ipv6-tunnel-mode disable
        set theme "default"
        set client-settings
            set forticlient-download enable
            set sslvpn-plugin-download enable
            set custom-client-app-url disable
        end
        config bookmark-group
            edit "default-group"
            next
        end
        set split-tunneling enable <!-- Recommended for performance; only internal traffic goes through VPN -->
        set tunnel-ipv6-pools ""
    next
end

Key settings here include:

  • set tunnel-mode enable: Allows FortiClient to establish a full tunnel.
  • set web-mode enable: Allows browser-based access to web applications, file shares, etc.
  • set ip-pools "SSLVPN_Tunnel_Addresses": Assigns IP addresses from our previously defined pool.
  • set split-tunneling enable: Crucial for performance. Only traffic destined for internal networks is routed through the VPN; internet traffic goes direct. Disable this if all traffic must pass through the FortiGate (e.g., for full inspection or specific egress IP).
  • set forticlient-download enable: Allows users to download the FortiClient from the portal.

Assigning Portals to User Groups

Finally, link the user group to the appropriate portal.

config vpn ssl web user-group-bookmark
    edit 0
        set user-group "SSLVPN_Users"
        set portal "full-access"
    next
end

This ensures members of the SSLVPN_Users group are directed to the full-access portal upon successful authentication.

Firewall Policy for SSL VPN Traffic

Even after a user connects via SSL VPN, the FortiGate firewall must explicitly permit their traffic to internal resources.

config firewall policy
    edit 0
        set name "SSLVPN_to_Internal"
        set srcintf "ssl.root" <!-- The virtual interface for SSL VPN clients -->
        set dstintf "internal" <!-- Or your specific internal LAN interface -->
        set srcaddr "SSLVPN_Tunnel_Addresses" <!-- The IP pool assigned to VPN clients -->
        set dstaddr "all"
        set action accept
        set service "ALL" <!-- Restrict services based on need; e.g., HTTP, HTTPS, RDP -->
        set schedule "always"
        set groups "SSLVPN_Users"
        set nat enable <!-- Typically enabled for SSL VPN traffic to internal -->
        set logtraffic all
    next
end

Key elements of this policy:

  • set srcintf "ssl.root": This is the virtual interface representing all SSL VPN connections.
  • set dstintf "internal": Replace "internal" with the name of your internal LAN interface (e.g., "port1", "lan", etc.).
  • set srcaddr "SSLVPN_Tunnel_Addresses": Specifies the source IP range for accepted traffic, ensuring only VPN clients can use this policy.
  • set dstaddr "all": Allows access to all destinations on the internal network. This should be restricted to specific address objects or groups representing the resources users need to access.
  • set service "ALL": Highly recommended to narrow this down (e.g., "HTTP", "HTTPS", "RDP", "SMB") to follow the principle of least privilege.
  • set groups "SSLVPN_Users": Binds the policy to the SSL VPN user group, ensuring only authenticated and authorized users can utilize this access.
  • set nat enable: Often required if the internal network does not have routes back to the SSLVPN_Tunnel_Addresses subnet.

Testing the SSL VPN Connection

Once configured, test the SSL VPN:

  1. Browser Access: Navigate to https://<FortiGate_WAN_IP>:10443. You should see the FortiGate SSL VPN login page.
  2. FortiClient: Download and install FortiClient (available from Fortinet's support site or directly from the FortiGate portal if enabled). Create a new VPN connection, select SSL-VPN, and enter the remote gateway <FortiGate_WAN_IP>:10443.
  3. Authentication: Log in with the configured user credentials.
  4. Connectivity Test: After connecting, attempt to access internal resources (e.g., ping an internal server, access a web application, RDP to a desktop).

Common Pitfalls and Troubleshooting

  • Incorrect Firewall Policy: Ensure the firewall policy permits traffic from ssl.root to your internal network and that the correct srcaddr, dstaddr, and service are specified. Always double-check the groups binding.
  • Routing Issues: If nat enable is off in the firewall policy, ensure your internal network routers have a route back to the SSL VPN tunnel IP range (e.g., 10.212.134.0/24 via the FortiGate's internal IP).
  • Certificate Warnings: If using the factory certificate, users will receive browser warnings. Deploying a trusted, publicly signed certificate resolves this.
  • Port Conflicts: Verify that port 10443 (or your chosen port) is not already in use by another service on the FortiGate or blocked by an upstream firewall.
  • User Authentication Failure: Check user passwords, 2FA settings, and ensure the user is a member of the correct SSL VPN user group. For LDAP/RADIUS, verify connectivity and correct bind DN/credentials.
  • Split Tunneling vs. Full Tunneling: If users can reach internal resources but not the internet when connected, or vice-versa, verify the split-tunneling setting in the portal and corresponding firewall policies for internet access (e.g., from ssl.root to wan1 with NAT).
  • FortiClient Version Compatibility: Ensure you're using a FortiClient version compatible with your FortiOS version (e.g., FortiClient 7.0 for FortiOS 7.0).

Back to the knowledge base · Ask the AI assistant