Agentless VPN multi-realm

This sample shows how to create a multi-realm Agentless VPN that provides different portals for different user groups.

Sample topology

Sample configuration

WAN interface is the interface connected to ISP. This example shows static mode. You can also use DHCP or PPPoE mode. The Agentless VPN connection is established over the WAN interface.

To configure Agentless VPN using the GUI:

1. Configure the interface and firewall address. The port1 interface connects to the internal network.

   1. Go to Network > Interfaces and edit the wan1 interface.

   2. Set IP/Network Mask to 172.20.120.123/255.255.255.0.

   3. Edit port1 interface and set IP/Network Mask to 192.168.1.99/255.255.255.0.

   4. Click OK.

   5. Go to Policy & Objects > Address and create an address for internet QA_subnet with subnet 192.168.1.0/24 and HR_subnet with subnet 10.1.100.0/24.

2. Configure user and user group.

   1. Go to User & Authentication > User Definition to create local users qa-user1 and hr-user1.

   2. Go to User & Authentication > User Groups to create separate user groups for web-only and full-access portals:

      • QA_group with member qa-user1.

      • HR_group with the member hr-user1.

3. Configure Agentless VPN portal.

   1. Go to VPN > Agentless VPN Portals to create portal qa-tunnel, and complete other configurations, such as Bookmarks, as required.

   2. Create another portal named hr-web with its own bookmark configuration.

   3. Create another portal named portal-access-disabled, and disable Agentless VPN on it using CLI:

      config vpn ssl web portal
          edit "portal-access-disabled"
              set web-mode disable
          next
      end

4. Configure Agentless VPN realms.

   1. Go to System > Feature Visibility to enable Agentless VPN Realms.

   2. Go to VPN > Agentless VPN Realms to create realms for qa and hr.

   3. (Optional) To access each realm with FQDN instead of the default URLs https://172.20.120.123:10443/hr and https://172.20.120.123:10443/qa, you can configure a virtual-host for the realm in the CLI.

      config vpn ssl web realm
          edit hr
              set virtual-host hr.mydomain.com
          next
          edit qa
              set virtual-host qa.mydomain.com
          next
      end

      Where mydomain.com is the name of your domain. Ensure FQDN resolves to the FortiGate wan1 interface and that your certificate is a wildcard certificate.

5. Configure Agentless VPN settings.

   1. Go to VPN > Agentless VPN Settings.

   2. Enable Agentless VPN status.

   3. For Listen on Interface(s), select wan1.

   4. Set Listen on Port to 10443.

   5. Choose a certificate for Server Certificate. The default is Fortinet_Factory.

   6. In Authentication/Portal Mapping All Other Users/Groups, set the Portal to portal-access-disabled.

   7. Create new Authentication/Portal Mapping for group QA_group mapping portal qa-tunnel.

   8. Specify the realm qa.

   9. Add another entry for group HR_group mapping portal hr-web.

   10. Specify the realm hr.

6. Configure Agentless VPN firewall policy.

   1. Go to Policy & Objects > Firewall Policy.

   2. Create a firewall policy for QA access.

   3. Fill in the firewall policy name. In this example, QA agentlessvpn access.

   4. Incoming interface must be Agentless VPN tunnel interface (ssl.root).

   5. Choose an Outgoing Interface. In this example, port1.

   6. Set the Source to all and User/group to QA_group.

   7. In this example, the Destination is the internal protected subnet QA_subnet.

   8. Set Schedule to always, Service to ALL, and Action to Accept.

   9. Click OK.

   10. Create a firewall policy for HR access.

   11. Fill in the firewall policy name. In this example, HR agentlessvpn access.

   12. Incoming interface must be Agentless VPN tunnel interface (ssl.root).

   13. Choose an Outgoing Interface. In this example, port1.

   14. Set the Source to all and User/group to HR_group.

   15. In this example, the Destination is the internal protected subnet HR_subnet.

   16. Set Schedule to always, Service to ALL, and Action to Accept.

   17. Click OK.

To configure Agentless VPN using the CLI:

1. Configure the interface and firewall address.

   config system interface 
       edit "wan1"
           set vdom "root"
           set ip 172.20.120.123 255.255.255.0
       next
   end

2. Configure internal interface and protected subnet, then connect the port1 interface to the internal network.

   config system interface
       edit "port1"
           set vdom "root"
           set ip 192.168.1.99 255.255.255.0
       next
   end

   config firewall address
       edit "QA_subnet"
           set subnet 192.168.1.0 255.255.255.0
       next
       edit "HR_subnet"
           set subnet 10.1.100.0 255.255.255.0
       next
   end

3. Configure user and user group.

   config user local
       edit "qa_user1" 
           set type password
           set passwd your-password
       next 
   end
   config user group
       edit "QA_group" 
           set member "qa_user1"
       next 
   end

   config user local
       edit "hr_user1" 
           set type password
           set passwd your-password
       next 
   end
   config user group
       edit "HR_group" 
           set member "hr_user1"
       next 
   end

4. Configure Agentless VPN web portal each for HR and QA. Create another portal with Agentless VPN disabled.

   config vpn ssl web portal
       edit "portal-access-disabled"
           set web-mode disable
       next
       edit "qa-portal"
           set web-mode enable
           config bookmark-group
               edit "gui-bookmarks"
   			config bookmarks
   			...
               next
           end
       next
       edit "hr-portal"
           set web-mode enable
           config bookmark-group
               edit "gui-bookmarks"
   			config bookmarks
   			...
               next
           end
       next
   end

5. Configure Agentless VPN realms.

   config vpn ssl web realm
       edit hr
           set virtual-host hr.mydomain.com
       next
       edit qa
           set virtual-host qa.mydomain.com
       next
   end
   

   The set virtual-host setting is optional. For example:

   config vpn ssl web realm
       edit hr
       next
       edit qa
       next
   end

6. Configure Agentless VPN settings.

   config vpn ssl settings
       set banned-cipher SHA1 SHA256 SHA384
       set servercert "Fortinet_Factory"
       set login-attempt-limit 0
       set port 10443
       set source-interface "port1"
       set source-address "all"
       set default-portal "portal-access-disabled"
       config authentication-rule
           edit 1
               set groups "HR_group"
               set portal "hr-portal"
               set realm "hr"
           next
           edit 2
               set groups "QA_group"
               set portal "qa-portal"
               set realm "qa"
           next
       end
   end

7. Configure two Agentless VPN firewall policies to allow remote QA user to access internal QA bookmark network and HR user to access HR bookmark network.

   config firewall policy 
       edit 1
           set name "QA sslvnpn access"
           set srcintf "ssl.root"
           set dstintf "port1"
           set srcaddr "all"
           set dstaddr "QA_subnet"        
           set action accept
           set schedule "always"
           set service "ALL"
           set groups “QA_group”
       next
       edit 2
           set name "HR sslvpn access"
           set srcintf "ssl.root"
           set dstintf "port1"
           set srcaddr "all"
           set dstaddr "HR_subnet"
           set action accept
           set schedule "always"
           set service "ALL"
           set groups “HR_group”
       next
   end

To see the results for HR and QA users:

1. In a web browser, log in to the portal https://172.20.120.123:10443/hr and https://172.20.120.123:10443/qa using the credentials you've set up.

2. Alternatively, if a virtual-host is specified, use the FQDN defined for the realm (hr.mydomain.com or qa.mydomain.com).

To check the Agentless VPN connection using the GUI:

1. On FortiGate, go to Dashboard > Agentless VPN Monitor to verify the list of Agentless VPN users.

   If the Agentless VPN Monitor is hidden, click + under the Dashboard, search for Agentless VPN Monitor, and add it to the display.

2. Go to Log & Report > System Events, and use the dropdown to select VPN Events to view VPN logs.