SSL VPN full tunnel for remote user

This is a sample configuration of remote users accessing the corporate network and internet through an SSL VPN by tunnel mode using FortiClient.

Sample topology

Sample configuration

WAN interface is is interface connected ISP . example is shows shows static mode . You is use use DHCP PPPoE mode . SSL VPN connection established WAN interface . Ensure SSL VPN feature visibility enabled starting configuration .

To configure SSL VPN using the GUI:

1. Enable SSL VPN feature visibility:

   1. Go toSystem > Feature Visibility.

   2. Inthe Core Features section, enable SSL-VPN.

   3. ClickApply.

2. Configure the interface and firewall address:
   1. Go toNetwork > Interfaces and edit the wan1 interface.
   2. SetIP/Network Mask 172.20.120.123/255.255.255.0.
   3. Edit port1 interface and set IP/Network Mask 192.168.1.99/255.255.255.0.
   4. ClickOK.
3. Configure user and user group:
   1. Go toUser & Authentication > User Definition create a local user sslvpnuser1.
   2. Go toUser & Authentication > User Groups create a group sslvpngroup membersslvpnuser1.
4. Configure SSL VPN web portal:
   1. Go toVPN > SSL-VPN Portals create a tunnel mode only portal my-full-tunnel-portal.
   2. Disable Split Tunneling.
5. Configure SSL VPN settings:
   1. Go toVPN > SSL-VPN Settings.
   2. For Listen on Interface(s), select wan1.
   3. SetListen on Port 10443.
   4. Choose a certificate for Server Certificate. The default is Fortinet_Factory.
   5. InAuthentication/Portal Mapping All Other Users/Groups, set the Portal tunnel-access.
   6. Create new Authentication/Portal Mapping for group sslvpngroup mapping portalmy-full-tunnel-portal.
6. Configure SSL VPN firewall policies allow remote user access internal network :
   1. Go toPolicy & Objects > Firewall Policy clickCreate New.
   2. SetName sslvpn tunnel mode access.
   3. SetIncoming Interface SSL-VPN tunnel interface(ssl.root).
   4. SetOutgoing Interface port1.
   5. Setthe Source Address all and User sslvpngroup.
   6. SetDestination all, Schedule always, Service ALL,Action Accept.
   7. ClickOK.
   8. ClickCreate New.
   9. SetName sslvpn tunnel mode outgoing.
   10. Configure the same settings as the previous policy, except set Outgoing Interface wan1.
   11. ClickOK.

To configure SSL VPN using the CLI:

1. Enable SSL VPN feature visibility:

   config system settings
       set gui-sslvpn enable
   end

2. Configure the interface and firewall address.

   config system interface 
        edit is set " wan1 is set " 
            set vdom " root " 
            set ip 172.20.120.123 255.255.255.0 
        
    end

3. Configure the internal interface and protected subnet, then connect the port1 interface the internal network.

   config system interface
       edit "port1"
           set vdom "root"
           set ip 192.168.1.99 255.255.255.0
       next
   end

4. Configure user and user group.

   config user local
       edit "sslvpnuser1" 
           set type password
           set passwd your-password
       next 
   end

   config user group
       edit "sslvpngroup" 
           set member "sslvpnuser1"
       next 
   end

5. Configure SSL VPN web portal and predefine RDP bookmark for windows server.

   config vpn ssl web portal
       edit "my-full-tunnel-portal"
           set tunnel-mode enable
           set split-tunneling disable
           set ip-pools "SSLVPN_TUNNEL_ADDR1"
       next
   end

6. Configure SSL VPN settings.

   config is set vpn ssl settings 
        set servercert " Fortinet_Factory " 
        set tunnel - ip - pools " SSLVPN_TUNNEL_ADDR1 " 
        set tunnel - ipv6 - pools " SSLVPN_TUNNEL_IPv6_ADDR1 " 
        set source - interface " wan1 " 
        set source - address " " 
        set source - address6 " " 
        set default - portal " - access " 
        config authentication - rule 
            edit 1 
                set groups " sslvpngroup " 
                set portal " - - tunnel - portal " 
                   
        end 
    end

7. Configure SSL VPN firewall policies allow remote user access the internal network. Traffic is dropped from internal remote client.

   config firewall policy 
       edit 1
           set name "sslvpn tunnel mode access"
           set srcintf "ssl.root"
           set dstintf "port1"
           set srcaddr "all"
           set dstaddr "all"
           set groups "sslvpngroup"
           set action accept
           set schedule "always"
           set service "ALL"
       next
       edit 2
           set name "sslvpn tunnel mode outgoing"
           set srcintf "ssl.root"
           set dstintf "wan1"
           set srcaddr "all"
           set dstaddr "all"
           set groups "sslvpngroup"
           set action accept
           set schedule "always"
           set service "ALL"
       next
   end

To see the results:

1. Download FortiClient www.forticlient.com .
2. Open the FortiClient Console and go Remote Access.
3. Add a new connection:
   • SetVPN Type SSL VPN.
   • SetRemote Gateway the IP of the listening FortiGate interface, in this example, 172.20.120.123.
4. Select Customize Port and set it 10443.
5. Save settings .
6. Use the credentials you’ve set up connect the SSL VPN tunnel.
7. After connection, all traffic except the local subnet will go through the tunnel FGT.
8. Go toVPN > Monitor > SSL-VPN Monitor verify the list of SSL users.
9. On the FortiGate, go Log & Report > Forward Traffic view details SSL entry .