Fortinet black logo

Cookbook

SSL VPN multi-realm

Copy Link
Copy Doc ID 4e2e9371-e0d6-11ea-96b9-00505692583a:724772
Download PDF

SSL VPN multi-realm

This sample shows how to create a multi-realm SSL VPN that provides different portals for different user groups.

Sample topology

Sample configuration

WAN interface is the interface connected to ISP. This example shows static mode. You can also use DHCP or PPPoE mode. The SSL VPN connection is established over the WAN interface.

Note

The split tunneling routing address cannot use an FQDN or an address group that includes an FQDN.

To configure SSL VPN using the GUI:
  1. Configure the interface and firewall address. The port1 interface connects to the internal network.
    1. Go to Network > Interfaces and edit the wan1 interface.
    2. Set IP/Network Mask to 172.20.120.123/255.255.255.0.
    3. Edit port1 interface and set IP/Network Mask to 192.168.1.99/255.255.255.0.
    4. Click OK.
    5. Go to Policy & Objects > Address and create an address for internet QA_subnet with subnet 192.168.1.0/24 and HR_subnet with subnet 10.1.100.0/24.
  2. Configure user and user group.
    1. Go to User & Device > User Definition to create local users qa-user1 and hr-user1.
    2. Go to User & Device > User Groups to create separate user groups for web-only and full-access portals:
      • QA_group with member qa-user1.
      • HR_group with the member hr-user1.
  3. Configure SSL VPN web portal.
    1. Go to VPN > SSL-VPN Portals to create portal qa-tunnel.
    2. Enable Tunnel Mode.
    3. Create a portal hr-web with Web Mode enabled.
  4. Configure SSL VPN realms.
    1. Go to System > Feature Visibility to enable SSL-VPN Realms.
    2. Go to VPN > SSL-VPN Realms to create realms for qa and hr.
    3. (Optional) To access each realm with FQDN instead of the default URLs https://172.20.120.123:10443/hr and https://172.20.120.123:10443/qa, you can configure a virtual-host for the realm in the CLI.

      config vpn ssl web realm

      edit hr

      set virtual-host hr.mydomain.com

      next

      edit qa

      set virtual-host qa.mydomain.com

      next

      end

      Where mydomain.com is the name of your domain. Ensure FQDN resolves to the FortiGate wan1 interface and that your certificate is a wildcard certificate.

  5. Configure SSL VPN settings.
    1. Go to VPN > SSL-VPN Settings.
    2. For Listen on Interface(s), select wan1.
    3. Set Listen on Port to 10443.
    4. Choose a certificate for Server Certificate. The default is Fortinet_Factory.
    5. In Authentication/Portal Mapping All Other Users/Groups, set the Portal to web-access.
    6. Create new Authentication/Portal Mapping for group QA_group mapping portal qa-tunnel.
    7. Specify the realm qa.
    8. Add another entry for group HR_group mapping portal hr-web.
    9. Specify the realm hr.
  6. Configure SSL VPN firewall policy.
    1. Go to Policy & Objects > IPv4 Policy.
    2. Create a firewall policy for QA access.
    3. Fill in the firewall policy name. In this example, QA sslvpn tunnel mode access.
    4. Incoming interface must be SSL-VPN tunnel interface(ssl.root).
    5. Choose an Outgoing Interface. In this example, port1.
    6. Set the Source to all and group to QA_group.
    7. In this example, the Destination is the internal protected subnet QA_subnet.
    8. Set Schedule to always, Service to ALL, and Action to Accept.
    9. Click OK.
    10. Create a firewall policy for HR access.
    11. Fill in the firewall policy name. In this example, HR sslvpn web mode access.
    12. Incoming interface must be SSL-VPN tunnel interface(ssl.root).
    13. Choose an Outgoing Interface. In this example, port1.
    14. Set the Source to all and group to HR_group.
    15. In this example, the Destination is the internal protected subnet HR_subnet.
    16. Set Schedule to always, Service to ALL, and Action to Accept.
    17. Click OK.
To configure SSL VPN using the CLI:
  1. Configure the interface and firewall address.
    config system interface 
        edit "wan1"
            set vdom "root"
            set ip 172.20.120.123 255.255.255.0
        next
    end
  2. Configure internal interface and protected subnet, then connect the port1 interface to the internal network.
    config system interface
        edit "port1"
            set vdom "root"
            set ip 192.168.1.99 255.255.255.0
        next
    end
    config firewall address
        edit "QA_subnet"
            set subnet 192.168.1.0 255.255.255.0
        next
        edit "HR_subnet"
            set subnet 10.1.100.0 255.255.255.0
        next
    end
  3. Configure user and user group.
    config user local
        edit "qa_user1" 
            set type password
            set passwd your-password
        next 
    end
    config user group
        edit "QA_group" 
            set member "qa_user1"
        next 
    end
    config user local
        edit "hr_user1" 
            set type password
            set passwd your-password
        next 
    end
    config user group
        edit "HR_group" 
            set member "hr_user1"
        next 
    end
  4. Configure SSL VPN web portal.
    config vpn ssl web portal
        edit "qa-tunnel"
            set tunnel-mode enable
            set ip-pools "SSLVPN_TUNNEL_ADDR1"
            set split-tunneling enable
            set split-tunneling-routing-address "QA_subnet"
        next
    end
    config vpn ssl web portal
        edit "hr-web"
            set web-mode enable
        next
    end
  5. Configure SSL VPN realms.

    config vpn ssl web realm

    edit hr

    set virtual-host hr.mydomain.com

    next

    edit qa

    set virtual-host qa.mydomain.com

    next

    end

    The set virtual-host setting is optional. For example:

    config vpn ssl web realm

    edit hr

    next

    edit qa

    next

    end

  6. Configure SSL VPN settings.
    config vpn ssl settings
        set servercert "Fortinet_Factory"
        set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"
        set tunnel-ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"
        set source-interface "wan1"
        set source-address "all"
        set source-address6 "all"
        set default-portal "full-access"
        config authentication-rule
            edit 1
                set groups "QA_group"
                set portal "qa-tunnel"
                set realm qa
            next  
            edit 2
                set groups "HR_group"
                set portal "hr-web"
                set realm hr
            next       
        end
    end
  7. Configure two SSL VPN firewall policies to allow remote QA user to access internal QA network and HR user to access HR network.
    config firewall policy 
        edit 1
            set name "QA sslvnpn tunnel access"
            set srcintf "ssl.root"
            set dstintf "port1"
            set srcaddr "all"
            set dstaddr "QA_subnet"
            set groups “QA_group”
            set action accept
            set schedule "always"
            set service "ALL"
        next
        edit 2
            set name "HR sslvpn web access"
            set srcintf "ssl.root"
            set dstintf "port1"
            set srcaddr "all"
            set dstaddr "HR_subnet"
            set groups “HR_group”
            set action accept
            set schedule "always"
            set service "ALL"
        next
    end
To see the results for QA user:
  1. Download FortiClient from www.forticlient.com.
  2. Open the FortiClient Console and go to Remote Access.
  3. Add a new connection.
    • Set VPN Type to SSL VPN.
    • Set Remote Gateway to https://172.20.120.123:10443/qa..
    • If a virtual-host is specified, use the FQDN defined for the realm (qa.mydomain.com).

  4. Select Customize Port and set it to 10443.
  5. Save your settings.
  6. Use the credentials you've set up to connect to the SSL VPN tunnel.

    If the user's computer has antivirus software, a connection is established; otherwise FortiClient shows a compliance warning.

  7. After connection, traffic to subnet 192.168.1.0 goes through the tunnel.
  8. On the FortiGate, go to VPN > Monitor > SSL-VPN Monitor to verify the list of SSL users.
  9. On the FortiGate, go to Log & Report > Forward Traffic and view the details of the traffic.
To see the results for HR user:
  1. In a web browser, log into the portal https://172.20.120.123:10443/hr using the credentials you've set up.
  2. Alternatively, if a virtual-host is specified, use the FQDN defined for the realm (hr.mydomain.com).
  3. Go to VPN > Monitor > SSL-VPN Monitor to verify the list of SSL users.
  4. Go to Log & Report > Forward Traffic and view the details of the traffic.

SSL VPN multi-realm

This sample shows how to create a multi-realm SSL VPN that provides different portals for different user groups.

Sample topology

Sample configuration

WAN interface is the interface connected to ISP. This example shows static mode. You can also use DHCP or PPPoE mode. The SSL VPN connection is established over the WAN interface.

Note

The split tunneling routing address cannot use an FQDN or an address group that includes an FQDN.

To configure SSL VPN using the GUI:
  1. Configure the interface and firewall address. The port1 interface connects to the internal network.
    1. Go to Network > Interfaces and edit the wan1 interface.
    2. Set IP/Network Mask to 172.20.120.123/255.255.255.0.
    3. Edit port1 interface and set IP/Network Mask to 192.168.1.99/255.255.255.0.
    4. Click OK.
    5. Go to Policy & Objects > Address and create an address for internet QA_subnet with subnet 192.168.1.0/24 and HR_subnet with subnet 10.1.100.0/24.
  2. Configure user and user group.
    1. Go to User & Device > User Definition to create local users qa-user1 and hr-user1.
    2. Go to User & Device > User Groups to create separate user groups for web-only and full-access portals:
      • QA_group with member qa-user1.
      • HR_group with the member hr-user1.
  3. Configure SSL VPN web portal.
    1. Go to VPN > SSL-VPN Portals to create portal qa-tunnel.
    2. Enable Tunnel Mode.
    3. Create a portal hr-web with Web Mode enabled.
  4. Configure SSL VPN realms.
    1. Go to System > Feature Visibility to enable SSL-VPN Realms.
    2. Go to VPN > SSL-VPN Realms to create realms for qa and hr.
    3. (Optional) To access each realm with FQDN instead of the default URLs https://172.20.120.123:10443/hr and https://172.20.120.123:10443/qa, you can configure a virtual-host for the realm in the CLI.

      config vpn ssl web realm

      edit hr

      set virtual-host hr.mydomain.com

      next

      edit qa

      set virtual-host qa.mydomain.com

      next

      end

      Where mydomain.com is the name of your domain. Ensure FQDN resolves to the FortiGate wan1 interface and that your certificate is a wildcard certificate.

  5. Configure SSL VPN settings.
    1. Go to VPN > SSL-VPN Settings.
    2. For Listen on Interface(s), select wan1.
    3. Set Listen on Port to 10443.
    4. Choose a certificate for Server Certificate. The default is Fortinet_Factory.
    5. In Authentication/Portal Mapping All Other Users/Groups, set the Portal to web-access.
    6. Create new Authentication/Portal Mapping for group QA_group mapping portal qa-tunnel.
    7. Specify the realm qa.
    8. Add another entry for group HR_group mapping portal hr-web.
    9. Specify the realm hr.
  6. Configure SSL VPN firewall policy.
    1. Go to Policy & Objects > IPv4 Policy.
    2. Create a firewall policy for QA access.
    3. Fill in the firewall policy name. In this example, QA sslvpn tunnel mode access.
    4. Incoming interface must be SSL-VPN tunnel interface(ssl.root).
    5. Choose an Outgoing Interface. In this example, port1.
    6. Set the Source to all and group to QA_group.
    7. In this example, the Destination is the internal protected subnet QA_subnet.
    8. Set Schedule to always, Service to ALL, and Action to Accept.
    9. Click OK.
    10. Create a firewall policy for HR access.
    11. Fill in the firewall policy name. In this example, HR sslvpn web mode access.
    12. Incoming interface must be SSL-VPN tunnel interface(ssl.root).
    13. Choose an Outgoing Interface. In this example, port1.
    14. Set the Source to all and group to HR_group.
    15. In this example, the Destination is the internal protected subnet HR_subnet.
    16. Set Schedule to always, Service to ALL, and Action to Accept.
    17. Click OK.
To configure SSL VPN using the CLI:
  1. Configure the interface and firewall address.
    config system interface 
        edit "wan1"
            set vdom "root"
            set ip 172.20.120.123 255.255.255.0
        next
    end
  2. Configure internal interface and protected subnet, then connect the port1 interface to the internal network.
    config system interface
        edit "port1"
            set vdom "root"
            set ip 192.168.1.99 255.255.255.0
        next
    end
    config firewall address
        edit "QA_subnet"
            set subnet 192.168.1.0 255.255.255.0
        next
        edit "HR_subnet"
            set subnet 10.1.100.0 255.255.255.0
        next
    end
  3. Configure user and user group.
    config user local
        edit "qa_user1" 
            set type password
            set passwd your-password
        next 
    end
    config user group
        edit "QA_group" 
            set member "qa_user1"
        next 
    end
    config user local
        edit "hr_user1" 
            set type password
            set passwd your-password
        next 
    end
    config user group
        edit "HR_group" 
            set member "hr_user1"
        next 
    end
  4. Configure SSL VPN web portal.
    config vpn ssl web portal
        edit "qa-tunnel"
            set tunnel-mode enable
            set ip-pools "SSLVPN_TUNNEL_ADDR1"
            set split-tunneling enable
            set split-tunneling-routing-address "QA_subnet"
        next
    end
    config vpn ssl web portal
        edit "hr-web"
            set web-mode enable
        next
    end
  5. Configure SSL VPN realms.

    config vpn ssl web realm

    edit hr

    set virtual-host hr.mydomain.com

    next

    edit qa

    set virtual-host qa.mydomain.com

    next

    end

    The set virtual-host setting is optional. For example:

    config vpn ssl web realm

    edit hr

    next

    edit qa

    next

    end

  6. Configure SSL VPN settings.
    config vpn ssl settings
        set servercert "Fortinet_Factory"
        set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"
        set tunnel-ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"
        set source-interface "wan1"
        set source-address "all"
        set source-address6 "all"
        set default-portal "full-access"
        config authentication-rule
            edit 1
                set groups "QA_group"
                set portal "qa-tunnel"
                set realm qa
            next  
            edit 2
                set groups "HR_group"
                set portal "hr-web"
                set realm hr
            next       
        end
    end
  7. Configure two SSL VPN firewall policies to allow remote QA user to access internal QA network and HR user to access HR network.
    config firewall policy 
        edit 1
            set name "QA sslvnpn tunnel access"
            set srcintf "ssl.root"
            set dstintf "port1"
            set srcaddr "all"
            set dstaddr "QA_subnet"
            set groups “QA_group”
            set action accept
            set schedule "always"
            set service "ALL"
        next
        edit 2
            set name "HR sslvpn web access"
            set srcintf "ssl.root"
            set dstintf "port1"
            set srcaddr "all"
            set dstaddr "HR_subnet"
            set groups “HR_group”
            set action accept
            set schedule "always"
            set service "ALL"
        next
    end
To see the results for QA user:
  1. Download FortiClient from www.forticlient.com.
  2. Open the FortiClient Console and go to Remote Access.
  3. Add a new connection.
    • Set VPN Type to SSL VPN.
    • Set Remote Gateway to https://172.20.120.123:10443/qa..
    • If a virtual-host is specified, use the FQDN defined for the realm (qa.mydomain.com).

  4. Select Customize Port and set it to 10443.
  5. Save your settings.
  6. Use the credentials you've set up to connect to the SSL VPN tunnel.

    If the user's computer has antivirus software, a connection is established; otherwise FortiClient shows a compliance warning.

  7. After connection, traffic to subnet 192.168.1.0 goes through the tunnel.
  8. On the FortiGate, go to VPN > Monitor > SSL-VPN Monitor to verify the list of SSL users.
  9. On the FortiGate, go to Log & Report > Forward Traffic and view the details of the traffic.
To see the results for HR user:
  1. In a web browser, log into the portal https://172.20.120.123:10443/hr using the credentials you've set up.
  2. Alternatively, if a virtual-host is specified, use the FQDN defined for the realm (hr.mydomain.com).
  3. Go to VPN > Monitor > SSL-VPN Monitor to verify the list of SSL users.
  4. Go to Log & Report > Forward Traffic and view the details of the traffic.