Dual stack IPv4 and IPv6 support for SSL VPN

Dual stack IPv4 and IPv6 support for SSL VPN servers and clients enables a client to establish a dual stack tunnel to allow both IPv4 and IPv6 traffic to pass through. FortiGate SSL VPN clients also support dual stack, which allows it to establish dual stack tunnels with other FortiGates.

Users connecting in web mode can connect to the web portal over IPv4 or IPv6. They can access bookmarks in either IPv4 or IPv6, depending on the preferred DNS setting of the web portal.

Example

In this example, FortiGate B works as an SSL VPN server with dual stack enabled. A test portal is configured to support tunnel mode and web mode SSL VPN.

FortiGate A is an SSL VPN client that connects to FortiGate B to establish an SSL VPN tunnel connection. It attempts to access www.bing.com and www.apple.com via separate IPv4 and IPv6 connections. Two addresses are configured on FortiGate B:

  • bing.com uses IPv4 FQDN and resolves to 13.107.21.200 and 204.79.197.200.
  • apple_v6 uses IPv6 FQDN and resolves to 2600:140a:c000:385::1aca and 2600:140a:c000:398::1aca.

The server certificate used is fgt_gui_automation, and the CN is *.fos.automation.com.

A PC serves as a client to connect to FortiGate B in SSL VPN web mode. The PC can connect to the SSL VPN server over IPv4 or IPv6. Based on the preferred DNS setting, it will access the destination website over IPv4 or IPv6.

Note

Dual stack tunnel mode support requires a supported client. In 7.0.0, a FortiGate in SSL VPN client mode can support dual stack tunnels. FortiClient 7.0.1 and later releases support dual stack.

To configure an SSL VPN server in tunnel and web mode with dual stack support in the GUI:
  1. Create a local user:

    1. Go to User & Authentication > User Definition and click Create New. The Users/Groups Creation Wizard opens.

    2. Set the User Type to Local User and click Next.

    3. Enter the Username (client2) and password, then click Next.

    4. Optionally, configure the contact information and click Next.

    5. Click Submit.

  2. Configure the addresses:

    1. Go to Policy & Objects > Addresses and click Create New > Address.

    2. Enter the following for the IPv4 address:

      Category

      Address

      Name

      bing.com

      Type

      FQDN

      FQDN

      www.bing.com

    3. Click OK.

    4. Click Create New > Address and enter the following for the IPv6 address:

      Category

      IPv6 Address

      Name

      apple_v6

      Type

      FQDN

      FQDN

      www.apple.com

    5. Click OK.

  3. Configure the SSL VPN portal:

    1. Go to VPN > SSL-VPN Portals and click Create New.

    2. Enter a name (testportal1).

    3. Enable Tunnel Mode and for Enable Split Tunneling, select Enable Based on Policy Destination.

    4. For Source IP Pools, add SSLVPN_TUNNEL_ADDR1.

    5. Enable IPv6 Tunnel Mode and for Enable Split Tunneling, select Enable Based on Policy Destination.

    6. For Source IP Pools, add SSLVPN_TUNNEL_IPv6_ADDR1.

    7. Enable Enable Web Mode.

    8. Click OK.

  4. Configure the SSL VPN settings:

    1. Go to VPN > SSL-VPN Settings and configure the following:

      Listen on Interface(s)

      port1

      Listen on Port

      1443

      Restrict Access

      Allow access from any host

      Server Certificate

      fgt_gui_automation

      Address Range

      Automatically assign addresses

      DNS Server

      Same as client system DNS

      Authentication/Portal Mapping

      Edit the All Other Users/Groups entry to use testportal1.

    2. Click Apply.

    3. Enable dual stack in the CLI:

      config vpn ssl settings
          set dual-stack-mode enable
      end
  5. Configure the firewall policy:

    1. Go to Policy & Objects > Firewall Policy and click Create New.

    2. Enter the following:

      Name

      sslvpn

      Incoming Interface

      ssl.root

      Outgoing Interface

      port2

      Source

      all (IPv4), all (IPv6), client2

      Destination

      bing.com, apple_v6

      Schedule

      Always

      Service

      All

      NAT

      Enabled

    3. Click OK.

To configure FortiGate A as an SSL VPN client in the GUI:
  1. Create a peer to verify the server certificate:

    Note

    The PKI menu is only available in the GUI (User & Authentication > PKI) after a PKI user has been created using the CLI, and a CN can only be configured in the CLI.

    If the CA is not known or is public, import the CA that signed the server certificate.

    1. Go to User & Authentication > PKI and click Create New.

    2. Set the Name to fgt_gui_automation.

    3. Set CA to the CA certificate that is used to verify the server certificate.

    4. Click OK.

    5. In the CLI, specify the CN that must be matched:

      config user peer
          edit "fgt_gui_automation"
              set ca "GUI_CA"
              set cn "*.fos.automation.com"
          next
      end
  2. Configure the SSL VPN client:

    1. Go to VPN > SSL-VPN Clients and click Create New.

    2. In the Interface dropdown, click Create.

      1. Enter a Name (sslclient_port2).

      2. Set Interface to port2.

      3. Set Role to LAN.

      4. Click OK.

    3. Configure the SSL VPN client:

      Name

      sslclientTo9

      Interface

      sslclient_port2

      Server

      Either IPv4 address 10.1.100.9 or IPv6 address 2000:10:1:100::9 can be used and will have the same results.

      Port

      1443

      Username

      client2

      Pre-shared Key

      ******

      Peer

      fgt_gui_automation

      Status

      Enabled

    4. Click OK.

To configure FortiClient and connect to the VPN:
  1. On the Remote Access tab and click Configure VPN, or if other connections have already been configured, click the sandwich icon and select Add a new connection.

  2. Set Connection Name to FGT2500E, and Remote Gateway to 10.1.100.9.

  3. Enable Customize port and enter the port number 1443.

  4. Set Username to client2.

  5. Enable Enable Dual-stack IPv6/IPv6 address.

  6. Click Save.

  7. Enter the password, then click Connect.

To configure an SSL VPN server in tunnel and web mode with dual stack support in the CLI: