SSL VPN web mode for remote user

This is a sample configuration of remote users accessing the corporate network through an SSL VPN by web mode using a web browser.

Sample topology

Sample configuration

WAN interface is the interface connected to ISP. This example shows static mode. You can also use DHCP or PPPoE mode. The SSL VPN connection is established over the WAN interface.

To configure SSL VPN using the GUI:
  1. Configure the interface and firewall address. The port1 interface connects to the internal network.
    1. Go to Network > Interfaces and edit the wan1 interface.
    2. Set IP/Network Mask to 172.20.120.123/255.255.255.0.
    3. Edit port1 interface and set IP/Network Mask to 192.168.1.99/255.255.255.0.
    4. Click OK.
    5. Go to Policy & Objects > Address and create an address for internet subnet 192.168.1.0.
  2. Configure user and user group.
    1. Go to User & Authentication > User Definition to create a local user sslvpnuser1.
    2. Go to User & Authentication > User Groups to create a group sslvpngroup with the member sslvpnuser1.
  3. Configure SSL VPN web portal.
    1. Go to VPN > SSL-VPN Portals to create a web mode only portal my-web-portal.
    2. Set Predefined Bookmarks for Windows server to type RDP.
  4. Configure SSL VPN settings.
    1. Go to VPN > SSL-VPN Settings.
    2. For Listen on Interface(s), select wan1.
    3. Set Listen on Port to 10443.
    4. Choose a certificate for Server Certificate.
      Caution

      It is HIGHLY recommended that you acquire a signed certificate for your installation. Please review the SSL VPN best practices and learn how to Procuring and importing a signed SSL certificate.

    5. In Authentication/Portal Mapping All Other Users/Groups, set the Portal to web-access.
    6. Create new Authentication/Portal Mapping for group sslvpngroup mapping portal my-Web-portal.
  5. Configure SSL VPN firewall policy.
    1. Go to Policy & Objects > Firewall Policy.
    2. Fill in the firewall policy name. In this example, sslvpn web mode access.
    3. Incoming interface must be SSL-VPN tunnel interface(ssl.root).
    4. Choose an Outgoing Interface. In this example, port1.
    5. Set the Source to all and group to sslvpngroup.
    6. In this example, the Destination is the internal protected subnet 192.168.1.0.
    7. Set Schedule to always, Service to ALL, and Action to Accept.
    8. Click OK.
To configure SSL VPN using the CLI: