Agentless VPN for remote users

This is a sample configuration of remote users accessing the corporate network through an Agentless VPN web portal.

Sample topology

Sample configuration

WAN interface is the interface connected to ISP using a static IP. You can also use DHCP or PPPoE mode on WAN1 interface. The Agentless VPN’s SSL tunnel is established over the WAN interface. By default, Agentless VPN settings are disabled and hidden from the GUI and CLI.

To enable Agentless VPN feature and Agentless VPN feature visibility in FortiOS:

1. Enable Agentless VPN using the CLI:

   config system global
       set sslvpn-web-mode enable
   end

2. Enable Agentless VPN feature visibility.

   1. In the GUI:

      1. Go to System > Feature Visibility.

      2. In the Core Features section, enable Agentless VPN.

      3. Click Apply.

   2. In the CLI:

      config system settings
          set gui-sslvpn enable
      end

To configure Agentless VPN using the GUI:

1. Configure the interface and firewall address. The port1 interface connects to the internal network.

   1. Go to Network > Interfaces and edit the wan1 interface.

   2. Set IP/Network Mask to 172.20.120.123/255.255.255.0.

   3. Edit port1 interface and set IP/Network Mask to 192.168.1.99/255.255.255.0.

   4. Click OK.

   5. Go to Policy & Objects > Address and create an address for internet subnet 192.168.1.0.

2. Configure user and user group.

   1. Go to User & Authentication > User Definition to create a local user agentlessvpnuser1.

   2. Go to User & Authentication > User Groups to create a group agentlessvpngroup with the member agentlessvpnuser1.

3. Configure Agentless VPN portals.

   1. Go to VPN > Agentless VPN Portals, and click Create New.

   2. Enter a name, such as agentless-portal.

   3. Under Predefined Bookmarks, click Create New, and enter the following details:

      Field	Value
      Name	Windows Server
      Type	RDP
      Host	192.168.1.114
      Port	3389
      Single Sign-On	Disable
      Username	Set the username to log in to Windows Server.
      Password	Set the password to log in to Windows Server.
      Port	3389

   4. Click OK to save the predefined bookmark.

   5. Click OK to save the portal settings.

   6. Create another Agentless VPN portal and name it portal-access-disabled.

   7. Click OK to save the portal settings.

   8. Disable Agentless VPN for the newly created portal (that is, portal-access-disabled) using CLI:

      config vpn ssl web portal
          edit "portal-access-disabled"
              set web-mode disable
          next
      end

4. Configure Agentless VPN settings.

   1. Go to VPN > Agentless VPN Settings.

   2. Set Agentless VPN status to Enable.

   3. Set Listen on Interface(s) to wan1.

   4. Set Listen on Port to 10443.

   5. Choose a certificate for Server Certificate. The default is Fortinet_Factory.

   6. In Authentication/Portal Mapping, select All Other Users/Groups, and click Edit.

   7. Use Portal dropdown to select portal-access-disabled.

   8. Click OK.

   9. In Authentication/Portal Mapping, click Create New.

      1. Set Users/Groups to agentlessvpngroup.

      2. Set Portal to agentless-portal.

      3. Click OK.

   10. Click Apply to save the Agentless VPN settings.

5. Configure Agentless VPN firewall policy.

   1. Go to Policy & Objects > Firewall Policy, and click Create New.

   2. Set Name to Agentless VPN firewall policy.

   3. Set Schedule to always and Action to Accept.

   4. Set Incoming interface to Agentless VPN interface (ssl.root).

   5. Choose an Outgoing Interface. This example uses port1.

   6. Set the Source to all and User/group to agentlessvpngroup.

   7. In this example, the Destination is the internal, protected subnet 192.168.1.0.

   8. Set Service to ALL.

   9. Click OK.

To configure Agentless VPN using the CLI:

1. Configure the interface and firewall address.

   config system interface 
       edit "wan1"
           set vdom "root"
           set ip 172.20.120.123 255.255.255.0
       next
   end

2. Configure the internal interface and protected subnet, then connect the port1 interface to the internal network.

   config system interface
       edit "port1"
           set vdom "root"
           set ip 192.168.1.99 255.255.255.0
       next
   end

   config firewall address
       edit "192.168.1.0"
           set subnet 192.168.1.0 255.255.255.0
       next
   end

3. Configure user and user group.

   config user local
       edit "agentlessvpnuser1" 
           set type password
           set passwd your-password
       next 
   end

   config user group
       edit "agentlessvpngroup" 
           set member "vpnuser1"
       next 
   end

4. Configure Agentless VPN portal and predefine RDP bookmark for windows server.

   config vpn ssl web portal
       edit "agentless-portal"
           set web-mode enable
           config bookmark-group
               edit "gui-bookmarks"
                   config bookmarks
                       edit "Windows Server"
                           set apptype rdp
                           set host "192.168.1.114"
                           set port 3389
                           set logon-user "your-windows-server-user-name"
                           set logon-password your-windows-server-password
                       next
                   end
               next
           end
       next
   end

5. Configure another Agentless VPN portal and disable Agentless VPN on it.

   config vpn ssl web portal
       edit "portal-access-disabled"
           set web-mode disable
       next
   end

6. Configure one Agentless VPN firewall policy to allow remote users to access the internal network. This policy does not allow traffic initiated from internal network to remote client.

   config firewall policy 
       edit 1
           set name "Agentless VPN firewall policy"
           set srcintf "ssl.root"
           set dstintf "port1"
           set action accept
           set srcaddr "all"
           set dstaddr "192.168.1.0"
           set service "ALL"
           set nat enable
           set groups "agentlessvpngroup"
       next
   end

To see the results:

1. In a web browser, log in to the portal https://172.20.120.123:10443 using the credentials you've set up.

2. In the portal with the predefined bookmark, select the bookmark to begin an RDP session. If there are no predefined bookmarks, the Quick Connection tool can be used; see Quick Connection tool for more information.

3. On FortiGate, go to Dashboard > Agentless VPN Monitor to verify the list of Agentless VPN users.

   If the Agentless VPN Monitor is hidden, click + under the Dashboard, search for Agentless VPN Monitor, and add it to the display.

4. Go to Log & Report > System Events, and use the dropdown to select VPN Events to view VPN logs.