Enable SSL VPN on FortiGate and Connect SSL VPN Using FortiClient (Free Lab with Test Drive)
A secure sockets layer VPN (SSL VPN) enables individual users to access an organization's network, client-server applications, and internal network utilities and directories without the need for specialized software. SSL VPNs provide safe, secure communication via an encrypted connection for all types of devices, regardless of whether access to the network is via the public internet or another secure network.
SSL VPN Types
There are two major types of SSL VPNs:
SSL Portal VPN
In this type of SSL VPN, a user visits a website and enters credentials to initiate a secure connection. The SSL portal VPN allows for a single SSL connection to a website. Additionally, the user can access a variety of specific applications or private network services as defined by the organization.
Users can typically enter the gateway, or the hardware on a network that allows data to flow from one network to another, using any modern web browser, by entering the username and password provided by the VPN gateway service.
SSL Tunnel VPN
An SSL tunnel VPN allows a web browser to securely access multiple network services that are not just web-based via a tunnel that is under SSL. These services could be proprietary networks or software built for corporate use only that cannot be accessed directly via the internet. This VPN tunneling technology may require a browser with additional applications, such as JavaScript or Flash, installed to display active content.
In this post, we are using FortiGate VM in Azure to configure a SSL Tunnel VPN and using FortiClient to connect to it in our Test Drive environment.
Diagram
For FortiGate Test Drive:
Related Posts:
- Azure Fortigate VM Test Drive - Outbound Internet, Publish Internal Service, S2S VPN & Remote Access VPN
- Download and Launch Fortigate Virtual Machine in VMWare WorkStation
- Fortigate VPN Lab - IPSec, VTI, BGP
- Enable SSL VPN on FortiGate and Connect SSL VPN Using FortiClient
- FortiOS Configuration for FortiGate Firewalls (Tips and Tricks) 1
- FortiOS Configuration for FortiGate Firewalls (Tips and Tricks) 2
Enable SSL-VPN Feature
SSL-VPN Settings
1 VPN -> SSL-VPN Settings
Most settings are default. But you will need to add interface on the listen list. Ideally, change Listen on Port to a different port from 443. In this example, I am using 4443.
note: Default tunnel user range is only 10 ip addresses. If you have more than 10, you might want to increase it by customizing a larger range there.
2 Autentication/Portal mapping
Change All Other Users/Groups to have tunnel-access to Portal.
You can have an admin group / users to have full-access to Portal.
3 SSL VPN Client Address Range
By default, it is automatically assigned by FortiGate.
In the above screenshot, it uses automatically assign range: 10.212.134.200 -10.212.134.210
The range can be customized for larger numbers based on your usage.
Use Fortinet_Factory Server Certificate
To make lab as simple as we can, we are gonna use Fortinet_Factory cert.
It is possible to directly create your own certificate using Let's Encrypt.
You might get this cert warning message when you access the portal by using default cert since it wont be able verified:
Policies and Users
1 SSL VPN > LAN
This firewall rule is to allow SSL VPN network to access LAN (Internal) networks.
You will need to choose incoming interface, outgoing interface, source (including users), destination, and services. Others, you can keep it as default.
You can use NAT with outgoing interface address, which is your FortiGate LAN interface IP, or you can completely disable NAT.
Logging is also can be enabled for all sessions.
Here is how the SSL VPN Firewall Policy rule looks like:
2 Remote Users and Group
Create a Remote Users group. Add a couple of remote users into this group.
FortiClient Configuration and Connect to Remote
Remote Access VPN (IPSec)
Enable SSL VPN Web Portal
SSL VPN web mode gets the error as below when configured with SAML authentication.
- Make sure web-mode is enabled in the SSL VPN portal:
config vpn ssl web portal
edit "full-access"
set web-mode enable
Warning: Please note that the legacy SSL VPN web mode feature is disabled by the global sslvpn-web-mode setting.
-
As the warning displayed, web mode is disabled globally so can not enable it in the full-access portal directly.Enable the web-mode globally first:config sys globalset sslvpn-web-mode enableend
Now the web mode of SSL VPN should work as expected after enabling web-mode for specific portals. To enable the web mode for specific portals run the command as shown in step 1.
If the issue persists, contact the TAC team.
FortiGate # show vpn ssl web portal config vpn ssl web portal edit "full-access" set tunnel-mode enable set ipv6-tunnel-mode enable set web-mode enable set ip-pools "SSLVPN_TUNNEL_ADDR1" set ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1" next edit "web-access" set web-mode enable next edit "tunnel-access" set tunnel-mode enable set ipv6-tunnel-mode enable set ip-pools "SSLVPN_TUNNEL_ADDR1" set ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1" next end FortiGate #
C:/Users/WDAGUtilityAccount>ping 10.0.3.4 Pinging 10.0.3.4 with 32 bytes of data: Reply from 10.0.3.4: bytes=32 time=39ms TTL=63 Reply from 10.0.3.4: bytes=32 time=47ms TTL=63 Reply from 10.0.3.4: bytes=32 time=38ms TTL=63 Reply from 10.0.3.4: bytes=32 time=38ms TTL=63 Ping statistics for 10.0.3.4: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 38ms, Maximum = 47ms, Average = 40ms C:/Users/WDAGUtilityAccount>tracert 10.0.3.4 Tracing route to 10.0.3.4 over a maximum of 30 hops 1 33 ms 36 ms 37 ms 10.212.134.200 2 34 ms 35 ms 34 ms 10.0.3.4 Trace complete.
SSL VPN FortiClient Connect to Azure VPN Gateway's Remote site
There is a special use case, which FortiGate firewall is providing SSL VPN connection, but Azure VPN Gateway provides Site to Site connection to remote site. How can we get our FortiClient to connect to remote site through Azure VPN tunnel?
1. SSL VPN Portal
References
- Fortinet Product Downloads
- SSL VPN Explained
- https://azuremarketplace.microsoft.com/en-us/home
共有 0 条评论