SSL VPN web mode for remote user

This is a sample configuration of remote users accessing the corporate network through an SSL VPN by web mode using a web browser.

Sample topology

Sample configuration

WAN interface is the interface connected to ISP. This example shows static mode. You can also use DHCP or PPPoE mode. The SSL VPN connection is established over the WAN interface. Ensure that SSL VPN web mode and SSL VPN feature visibility are enabled before starting the configuration.

For FortiOS 7.4.0, SSL VPN web mode, explicit web proxy, and interface mode IPsec VPN features will not work with the following configuration: An IP pool with ARP reply enabled is configured. This IP pool is configured as the source IP address in a firewall policy for SSL VPN web mode, in a proxy policy for explicit web proxy, or as the local gateway in the Phase 1 settings for an interface mode IPsec VPN. A matching blackhole route is configured for IP pool reply traffic. Configuring an IP pool as the source NAT IP address in a regular firewall policy works as before. For details, see Technical Tip: IP pool and virtual IP behaviour changes in FortiOS 6.4, 7.0, 7.2, and 7.4.

To enable SSL VPN web mode and SSL VPN feature visibility in FortiOS:

1. Enable SSL VPN web mode:

   config system global
       set sslvpn-web-mode enable
   end

2. Enable SSL VPN feature visibility.

   1. In the GUI:

      1. Go to System > Feature Visibility.

      2. In the Core Features section, enable SSL-VPN.

      3. Click Apply.

   2. In the CLI:

      config system settings
          set gui-sslvpn enable
      end

To configure SSL VPN using the GUI:

1. Configure the interface and firewall address. The port1 interface connects to the internal network.
   1. Go to Network > Interfaces and edit the wan1 interface.
   2. Set IP/Network Mask to 172.20.120.123/255.255.255.0.
   3. Edit port1 interface and set IP/Network Mask to 192.168.1.99/255.255.255.0.
   4. Click OK.
   5. Go to Policy & Objects > Address and create an address for internet subnet 192.168.1.0.
2. Configure user and user group.
   1. Go to User & Authentication > User Definition to create a local user sslvpnuser1.
   2. Go to User & Authentication > User Groups to create a group sslvpngroup with the member sslvpnuser1.
3. Configure SSL VPN web portal.
   1. Go to VPN > SSL-VPN Portals to create a web mode only portal my-web-portal.
   2. Set Predefined Bookmarks for Windows server to type RDP.
4. Configure SSL VPN settings.
   1. Go to VPN > SSL-VPN Settings.
   2. For Listen on Interface(s), select wan1.
   3. Set Listen on Port to 10443.
   4. Choose a certificate for Server Certificate.

      It is HIGHLY recommended that you acquire a signed certificate for your installation. Please review the SSL VPN best practices and learn how to Procuring and importing a signed SSL certificate.

   5. In Authentication/Portal Mapping All Other Users/Groups, set the Portal to web-access.
   6. Create new Authentication/Portal Mapping for group sslvpngroup mapping portal my-Web-portal.
5. Configure SSL VPN firewall policy.
   1. Go to Policy & Objects > Firewall Policy.
   2. Fill in the firewall policy name. In this example, sslvpn web mode access.
   3. Incoming interface must be SSL-VPN tunnel interface(ssl.root).
   4. Choose an Outgoing Interface. In this example, port1.
   5. Set the Source to all and group to sslvpngroup.
   6. In this example, the Destination is the internal protected subnet 192.168.1.0.
   7. Set Schedule to always, Service to ALL, and Action to Accept.
   8. Click OK.

Do not set the virtual IP addresses as the destination address in a firewall policy when using SSL VPN web mode, as it will result in no destination address being accessible. Please note that the FortiOS SSL VPN web mode does not support mapping the virtual IP to the actual one.

To configure SSL VPN using the CLI:

1. Configure the interface and firewall address.

   config system interface 
       edit "wan1"
           set vdom "root"
           set ip 172.20.120.123 255.255.255.0
       next
   end

2. Configure the internal interface and protected subnet, then connect the port1 interface to the internal network.

   config system interface
       edit "port1"
           set vdom "root"
           set ip 192.168.1.99 255.255.255.0
       next
   end

   config firewall address
       edit "192.168.1.0"
           set subnet 192.168.1.0 255.255.255.0
       next
   end

3. Configure user and user group.

   config user local
       edit "sslvpnuser1" 
           set type password
           set passwd your-password
       next 
   end

   config user group
       edit "sslvpngroup" 
           set member "vpnuser1"
       next 
   end

4. Configure SSL VPN web portal and predefine RDP bookmark for windows server.

   config vpn ssl web portal
       edit "my-web-portal"
           set web-mode enable
           config bookmark-group
               edit "gui-bookmarks"
                   config bookmarks
                       edit "Windows Server"
                           set apptype rdp
                           set host "192.168.1.114"
                           set port 3389
                           set logon-user "your-windows-server-user-name"
                           set logon-password your-windows-server-password
                       next
                   end
               next
           end
       next
   end

5. Configure SSL VPN settings.

   config vpn ssl settings
       set servercert "Fortinet_Factory"
       set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"
       set tunnel-ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"
       set source-interface "wan1"
       set source-address "all"
       set source-address6 "all"
       set default-portal "full-access"
       config authentication-rule
           edit 1
               set groups "sslvpngroup"
               set portal "my-web-portal"
           next        
       end
   end

6. Configure one SSL VPN firewall policy to allow the remote user to access the internal network. Traffic is dropped from internal to remote client.

   config firewall policy 
       edit 1
           set name "sslvpn web mode access"
           set srcintf "ssl.root"
           set dstintf "port1"
           set srcaddr "all"
           set dstaddr "192.168.1.0"
           set groups “sslvpngroup”
           set action accept
           set schedule "always"
           set service "ALL"
       next
   end

   Do not set the virtual IP addresses as the destination address in a firewall policy when using SSL VPN web mode, as it will result in no destination address being accessible. Please note that the FortiOS SSL VPN web mode does not support mapping the virtual IP to the actual one.

To see the results:

1. In a web browser, log into the portal https://172.20.120.123:10443 using the credentials you've set up.
2. In the portal with the predefined bookmark, select the bookmark to begin an RDP session. If there are no predefined bookmarks, the Quick Connection tool can be used; see Quick Connection tool for more information.
3. Go to VPN > Monitor > SSL-VPN Monitor to verify the list of SSL users.
4. Go to Log & Report > Forward Traffic to view the details for the SSL entry.