{"id":167,"date":"2022-04-03T17:25:01","date_gmt":"2022-04-03T21:25:01","guid":{"rendered":"https:\/\/pressbooks.bccampus.ca\/fortigatefirewall\/chapter\/4-2-ssl-vpn\/"},"modified":"2025-12-11T14:45:18","modified_gmt":"2025-12-11T19:45:18","slug":"ssl-vpn","status":"publish","type":"chapter","link":"https:\/\/pressbooks.bccampus.ca\/fortigatefirewall\/chapter\/ssl-vpn\/","title":{"raw":"4.2 SSL VPN","rendered":"4.2 SSL VPN"},"content":{"raw":"
\r\n

Learning Objectives<\/p>\r\n\r\n<\/header>\r\n

\r\n
    \r\n \t
  • Configure a tunnel-based SSL VPN<\/li>\r\n \t
  • Configure a web-based SSL VPN (Web Portal)<\/li>\r\n<\/ul>\r\n<\/div>\r\n<\/div>\r\n
    Scenario<\/strong>: We are going to have SSL VPN from Windows to FortiGate Firewall. First, we will install FortiClient on Windows and then we will configure the firewall for FortiClient. We have two types of SSL VPN, Web based mode and Tunnel mode. Web based mode doesn't need any agents and you should be able to reach WordPress and SSH Server from Windows. Tunnel mode is through FortiClient. The goal of this scenario is to have connectivity from Windows to WordPress and SSH Server.<\/div>\r\n\r\n[caption id=\"attachment_166\" align=\"aligncenter\" width=\"1242\"]\"SSL Figure 4.38: Main scenario[\/caption]\r\n\r\n
    \r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n\r\n
    Table 4.3: Devices configuration<\/caption>\r\n
    Device<\/strong><\/th>\r\nIP address<\/strong><\/td>\r\nAccess<\/strong><\/td>\r\n<\/tr>\r\n
    FortiGate<\/td>\r\nPort3: 192.168.1.1\/24 - DHCP (192.168.1.20 to 192.168.1.30)\r\n\r\nPort2: DHCP Client<\/td>\r\nICMP-HTTP-HTTPS<\/td>\r\n<\/tr>\r\n
    WebTerm (FMC)<\/td>\r\n192.168.1.2\/24<\/td>\r\n-<\/td>\r\n<\/tr>\r\n
    KALI Linux (SSH Server)<\/td>\r\n192.168.1.3\/24<\/td>\r\n-<\/td>\r\n<\/tr>\r\n
    WordPress<\/td>\r\n192.168.1.4\/24<\/td>\r\n<\/td>\r\n<\/tr>\r\n
    KALI-outside<\/td>\r\nDHCP Client<\/td>\r\n<\/td>\r\n<\/tr>\r\n
    Windows<\/td>\r\nDHCP Client<\/td>\r\n<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n<\/div>\r\nConfigure the interfaces of the firewall. Port2 and Port3 should be configured in the terminal to access the firewall.\r\n
      \r\n \t
    1. Port 3 Configuration:\r\n\r\n[caption id=\"attachment_138\" align=\"aligncenter\" width=\"500\"]\"Port3 Figure 4.39: Port3 settings[\/caption]<\/li>\r\n \t
    2. Port 2 Configuration:\r\n\r\n[caption id=\"attachment_139\" align=\"aligncenter\" width=\"500\"]\"Port2 Figure 4.40: Port2 settings[\/caption]<\/li>\r\n \t
    3. Configure DHCP Server on port3.\r\n\r\n[caption id=\"attachment_166\" align=\"aligncenter\" width=\"997\"]\"Configure Figure 4.41: Enable DHCP Server on port3[\/caption]<\/li>\r\n \t
    4. Configure user and user group. Go to User & Authentication<\/strong> > User Definition<\/strong> to create a local user sslvpnuser1<\/strong>.\r\n\r\n[caption id=\"attachment_141\" align=\"aligncenter\" width=\"500\"]\"Step1- Figure 4.42: Create a local user[\/caption]\r\n\r\n[caption id=\"attachment_142\" align=\"aligncenter\" width=\"500\"]\"Configure Figure 4.43: Configure login credentials[\/caption]\r\n\r\nGo to User & Authentication<\/strong> > User Groups<\/strong> to create a group sslvpngroup<\/strong> with the member sslvpnuser1<\/strong>.\r\n\r\n[caption id=\"attachment_143\" align=\"aligncenter\" width=\"500\"]\"Create Figure 4.44: Create a group[\/caption]<\/li>\r\n \t
    5. Configure SSL VPN web portal and Tunnel mode. Go to\u00a0VPN > SSL-VPN<\/strong> Portals:\r\n
        \r\n \t
      • Tunnel Mode:<\/strong> Enable<\/span><\/li>\r\n \t
      • Split-Tunneling:<\/strong> Disabled<\/li>\r\n \t
      • Source IP Pools:<\/strong> SSLVPN_TUNNEL_ADDR1<\/li>\r\n<\/ul>\r\n[caption id=\"attachment_166\" align=\"aligncenter\" width=\"1146\"]\"SSL-VPN Figure 4.45: SSL-VPN Portal[\/caption]\r\n\r\nGo to VPN<\/strong> > SSL-VPN Portals<\/strong>, add KALI IP address (SSH Server: IP Address of Kali<\/em>) and WordPress (IP Address of WordPress<\/em>) in the bookmark section.\r\n\r\n[caption id=\"attachment_145\" align=\"aligncenter\" width=\"400\"]\"Create Figure 4.46: Create an SSH bookmark[\/caption]\r\n\r\n[caption id=\"attachment_146\" align=\"aligncenter\" width=\"400\"]\"Create Figure 4.47: Create an HTTP\/HTTPS bookmark[\/caption]\r\n\r\n[caption id=\"attachment_166\" align=\"aligncenter\" width=\"1092\"]\"Bookmark Figure 4.48: Bookmark settings[\/caption]<\/li>\r\n \t
      • Configure SSL VPN settings. Go to\u00a0VPN > SSL-VPN Settings<\/strong>:\r\n
          \r\n \t
        • For\u00a0Listen on Interface(s), select\u00a0Port2.<\/li>\r\n \t
        • Set\u00a0Listen on Port\u00a0to\u00a08080.<\/li>\r\n \t
        • Server Certificate: Fortinet_Factory<\/span><\/li>\r\n \t
        • In restrict Access, select \u201cAllow access from any host\u201d<\/li>\r\n \t
        • Address range: Automatically assign address.<\/strong><\/li>\r\n \t
        • In Authentication\/Portal Mapping All Other Users\/Groups, set the Portal to MyPortal<\/strong><\/li>\r\n \t
        • Create new Authentication\/Portal Mapping for group sslvpngroup<\/strong> mapping portal MyPortal.<\/li>\r\n<\/ul>\r\n[caption id=\"attachment_1120\" align=\"aligncenter\" width=\"1092\"]\"\" Figure 4.49: Enable SSL-VPN Settings<\/span>[\/caption]\r\n\r\n[caption id=\"attachment_149\" align=\"aligncenter\" width=\"400\"]\"Assign Figure 4.50: Assign sslvpngroup to MyPortal[\/caption]\r\n\r\n[caption id=\"attachment_150\" align=\"aligncenter\" width=\"500\"]\"Authentication\/Portal Figure 4.51: Authentication\/Portal Mapping[\/caption]<\/li>\r\n \t
        • Configure SSL VPN firewall policy:\r\n
            \r\n \t
          1. Go to Policy & Objects > Firewall Policy.<\/strong><\/li>\r\n \t
          2. Fill in the firewall policy name. In this example, SSLVPN<\/strong> full tunnel access.<\/li>\r\n \t
          3. The incoming interface must be SSL-VPN tunnel interface(ssl.root).<\/li>\r\n \t
          4. Choose an Outgoing Interface. In this example, port3.<\/li>\r\n \t
          5. Set the\u00a0Source\u00a0to\u00a0all\u00a0and group to\u00a0sslvpngroup<\/strong>.<\/li>\r\n \t
          6. Set the Destination to all.<\/li>\r\n \t
          7. Set\u00a0Schedule\u00a0to\u00a0always,\u00a0Service\u00a0to\u00a0ALL, and\u00a0Action\u00a0to\u00a0Accept.<\/li>\r\n<\/ol>\r\n[caption id=\"attachment_151\" align=\"aligncenter\" width=\"500\"]\"Configure Figure 4.52: Create a Firewall Policy for SSLVPN[\/caption]<\/li>\r\n \t
          8. Now connect to Kali outside and open the browser https:\/\/IP-PORT 2-Firewall:8080 in my case https:\/\/192.168.122.39:8080<\/strong>\r\nEnter the username and password you created earlier. Then try to connect to the KALI SSH Server and WordPress through the browser.\r\n\r\n[caption id=\"attachment_152\" align=\"aligncenter\" width=\"400\"]\"SSL Figure 4.53: SSL-VPN Portal[\/caption]\r\n\r\n[caption id=\"attachment_153\" align=\"aligncenter\" width=\"400\"]\"SSL Figure 4.54: SSL-VPN Portal[\/caption]\r\n\r\n[caption id=\"attachment_154\" align=\"aligncenter\" width=\"400\"]\"Verify Figure 4.55: Verify WordPress[\/caption]\r\n\r\n[caption id=\"attachment_155\" align=\"aligncenter\" width=\"400\"]\"Verify Figure 4.56: Verify SSH[\/caption]<\/li>\r\n \t
          9. Now, go to Windows and install FortiClient . Try to use FortiClient to connect through SSLVP<\/span>N.\r\n\r\n[caption id=\"attachment_156\" align=\"aligncenter\" width=\"400\"]\"Download Figure 4.57: Download FortiClient[\/caption]\r\n\r\n[caption id=\"attachment_157\" align=\"aligncenter\" width=\"400\"]\"FortiClient Figure 4.58: FortiClient Installation[\/caption]\r\n\r\n[caption id=\"attachment_158\" align=\"aligncenter\" width=\"400\"]\"FortiClient Figure 4.59: FortiClient Installation[\/caption]<\/li>\r\n \t
          10. Configure FortiClient.\r\n\r\n[caption id=\"attachment_159\" align=\"aligncenter\" width=\"400\"]\"Configure Figure 4.60: Configure FortiClient[\/caption]\r\n\r\n[caption id=\"attachment_160\" align=\"aligncenter\" width=\"500\"]\"Configure Figure 4.61: Configure SSLVPN[\/caption]<\/li>\r\n \t
          11. Verify configuration. Enter the Username and Password you have set for SSLVPN.\r\n\r\n[caption id=\"attachment_161\" align=\"aligncenter\" width=\"400\"]\"SSLVPN Figure 4.62: SSLVPN Credentials[\/caption]\r\n\r\nAccept the Certificate Issuer to have a secure connection.\r\n\r\n[caption id=\"attachment_162\" align=\"aligncenter\" width=\"450\"]\"Accept Figure 4.63: Click on Yes in Security Alert[\/caption]\r\n\r\n[caption id=\"attachment_163\" align=\"aligncenter\" width=\"400\"]\"Verify Figure 4.64: Verify SSLVPN Connection[\/caption]\r\n\r\nVerify your connectivity by entering the IP address of WordPress.\r\n\r\n[caption id=\"attachment_164\" align=\"aligncenter\" width=\"400\"]\"Verify Figure 4.65: Verify WordPress[\/caption]\r\n\r\nVerify your connectivity by entering the IP address of SSH Server.\r\n\r\n[caption id=\"attachment_165\" align=\"aligncenter\" width=\"450\"]\"Verify Figure 4.66: Verify SSH[\/caption]\r\n\r\n[caption id=\"attachment_166\" align=\"aligncenter\" width=\"450\"]\"Verify Figure 4.67: Verify SSH connection[\/caption]<\/li>\r\n<\/ol>","rendered":"
            \n
            \n

            Learning Objectives<\/p>\n<\/header>\n

            \n
              \n
            • Configure a tunnel-based SSL VPN<\/li>\n
            • Configure a web-based SSL VPN (Web Portal)<\/li>\n<\/ul>\n<\/div>\n<\/div>\n
              Scenario<\/strong>: We are going to have SSL VPN from Windows to FortiGate Firewall. First, we will install FortiClient on Windows and then we will configure the firewall for FortiClient. We have two types of SSL VPN, Web based mode and Tunnel mode. Web based mode doesn’t need any agents and you should be able to reach WordPress and SSH Server from Windows. Tunnel mode is through FortiClient. The goal of this scenario is to have connectivity from Windows to WordPress and SSH Server.<\/div>\n
              \"SSL
              Figure 4.38: Main scenario<\/figcaption><\/figure>\n
              \n\n\n\n\n\n\n\n\n\n
              Table 4.3: Devices configuration<\/caption>\n
              Device<\/strong><\/th>\nIP address<\/strong><\/td>\nAccess<\/strong><\/td>\n<\/tr>\n
              FortiGate<\/td>\nPort3: 192.168.1.1\/24 – DHCP (192.168.1.20 to 192.168.1.30)<\/p>\n

              Port2: DHCP Client<\/td>\n

              		ICMP-HTTP-HTTPS<\/td>\n<\/tr>\n
              WebTerm (FMC)<\/td>\n192.168.1.2\/24<\/td>\n–<\/td>\n<\/tr>\n
              KALI Linux (SSH Server)<\/td>\n192.168.1.3\/24<\/td>\n–<\/td>\n<\/tr>\n
              WordPress<\/td>\n192.168.1.4\/24<\/td>\n<\/td>\n<\/tr>\n
              KALI-outside<\/td>\nDHCP Client<\/td>\n<\/td>\n<\/tr>\n
              Windows<\/td>\nDHCP Client<\/td>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

              Configure the interfaces of the firewall. Port2 and Port3 should be configured in the terminal to access the firewall.<\/p>\n

                \n
              1. Port 3 Configuration:
                \n
                \"Port3
                Figure 4.39: Port3 settings<\/figcaption><\/figure>\n<\/li>\n
              2. Port 2 Configuration:
                \n
                \"Port2
                Figure 4.40: Port2 settings<\/figcaption><\/figure>\n<\/li>\n
              3. Configure DHCP Server on port3.
                \n
                \"Configure
                Figure 4.41: Enable DHCP Server on port3<\/figcaption><\/figure>\n<\/li>\n
              4. Configure user and user group. Go to User & Authentication<\/strong> > User Definition<\/strong> to create a local user sslvpnuser1<\/strong>.
                \n
                \"Step1-
                Figure 4.42: Create a local user<\/figcaption><\/figure>\n
                \"Configure
                Figure 4.43: Configure login credentials<\/figcaption><\/figure>\n

                Go to User & Authentication<\/strong> > User Groups<\/strong> to create a group sslvpngroup<\/strong> with the member sslvpnuser1<\/strong>.<\/p>\n

                \"Create
                Figure 4.44: Create a group<\/figcaption><\/figure>\n<\/li>\n
              5. Configure SSL VPN web portal and Tunnel mode. Go to\u00a0VPN > SSL-VPN<\/strong> Portals:\n
                  \n
                • Tunnel Mode:<\/strong> Enable<\/span><\/li>\n
                • Split-Tunneling:<\/strong> Disabled<\/li>\n
                • Source IP Pools:<\/strong> SSLVPN_TUNNEL_ADDR1<\/li>\n<\/ul>\n
                  \"SSL-VPN
                  Figure 4.45: SSL-VPN Portal<\/figcaption><\/figure>\n

                  Go to VPN<\/strong> > SSL-VPN Portals<\/strong>, add KALI IP address (SSH Server: IP Address of Kali<\/em>) and WordPress (IP Address of WordPress<\/em>) in the bookmark section.<\/p>\n

                  \"Create
                  Figure 4.46: Create an SSH bookmark<\/figcaption><\/figure>\n
                  \"Create
                  Figure 4.47: Create an HTTP\/HTTPS bookmark<\/figcaption><\/figure>\n
                  \"Bookmark
                  Figure 4.48: Bookmark settings<\/figcaption><\/figure>\n<\/li>\n
                • Configure SSL VPN settings. Go to\u00a0VPN > SSL-VPN Settings<\/strong>:\n
                    \n
                  • For\u00a0Listen on Interface(s), select\u00a0Port2.<\/li>\n
                  • Set\u00a0Listen on Port\u00a0to\u00a08080.<\/li>\n
                  • Server Certificate: Fortinet_Factory<\/span><\/li>\n
                  • In restrict Access, select \u201cAllow access from any host\u201d<\/li>\n
                  • Address range: Automatically assign address.<\/strong><\/li>\n
                  • In Authentication\/Portal Mapping All Other Users\/Groups, set the Portal to MyPortal<\/strong><\/li>\n
                  • Create new Authentication\/Portal Mapping for group sslvpngroup<\/strong> mapping portal MyPortal.<\/li>\n<\/ul>\n
                    \"\"
                    Figure 4.49: Enable SSL-VPN Settings<\/span><\/figcaption><\/figure>\n
                    \"Assign
                    Figure 4.50: Assign sslvpngroup to MyPortal<\/figcaption><\/figure>\n
                    \"Authentication\/Portal
                    Figure 4.51: Authentication\/Portal Mapping<\/figcaption><\/figure>\n<\/li>\n
                  • Configure SSL VPN firewall policy:\n
                      \n
                    1. Go to Policy & Objects > Firewall Policy.<\/strong><\/li>\n
                    2. Fill in the firewall policy name. In this example, SSLVPN<\/strong> full tunnel access.<\/li>\n
                    3. The incoming interface must be SSL-VPN tunnel interface(ssl.root).<\/li>\n
                    4. Choose an Outgoing Interface. In this example, port3.<\/li>\n
                    5. Set the\u00a0Source\u00a0to\u00a0all\u00a0and group to\u00a0sslvpngroup<\/strong>.<\/li>\n
                    6. Set the Destination to all.<\/li>\n
                    7. Set\u00a0Schedule\u00a0to\u00a0always,\u00a0Service\u00a0to\u00a0ALL, and\u00a0Action\u00a0to\u00a0Accept.<\/li>\n<\/ol>\n
                      \"Configure
                      Figure 4.52: Create a Firewall Policy for SSLVPN<\/figcaption><\/figure>\n<\/li>\n
                    8. Now connect to Kali outside and open the browser https:\/\/IP-PORT 2-Firewall:8080 in my case https:\/\/192.168.122.39:8080<\/strong>
                      \nEnter the username and password you created earlier. Then try to connect to the KALI SSH Server and WordPress through the browser.<\/p>\n
                      \"SSL
                      Figure 4.53: SSL-VPN Portal<\/figcaption><\/figure>\n
                      \"SSL
                      Figure 4.54: SSL-VPN Portal<\/figcaption><\/figure>\n
                      \"Verify
                      Figure 4.55: Verify WordPress<\/figcaption><\/figure>\n
                      \"Verify
                      Figure 4.56: Verify SSH<\/figcaption><\/figure>\n<\/li>\n
                    9. Now, go to Windows and install FortiClient . Try to use FortiClient to connect through SSLVP<\/span>N.
                      \n
                      \"Download
                      Figure 4.57: Download FortiClient<\/figcaption><\/figure>\n
                      \"FortiClient
                      Figure 4.58: FortiClient Installation<\/figcaption><\/figure>\n
                      \"FortiClient
                      Figure 4.59: FortiClient Installation<\/figcaption><\/figure>\n<\/li>\n
                    10. Configure FortiClient.
                      \n
                      \"Configure
                      Figure 4.60: Configure FortiClient<\/figcaption><\/figure>\n
                      \"Configure
                      Figure 4.61: Configure SSLVPN<\/figcaption><\/figure>\n<\/li>\n
                    11. Verify configuration. Enter the Username and Password you have set for SSLVPN.
                      \n
                      \"SSLVPN
                      Figure 4.62: SSLVPN Credentials<\/figcaption><\/figure>\n

                      Accept the Certificate Issuer to have a secure connection.<\/p>\n

                      \"Accept
                      Figure 4.63: Click on Yes in Security Alert<\/figcaption><\/figure>\n
                      \"Verify
                      Figure 4.64: Verify SSLVPN Connection<\/figcaption><\/figure>\n

                      Verify your connectivity by entering the IP address of WordPress.<\/p>\n

                      \"Verify
                      Figure 4.65: Verify WordPress<\/figcaption><\/figure>\n

                      Verify your connectivity by entering the IP address of SSH Server.<\/p>\n

                      \"Verify
                      Figure 4.66: Verify SSH<\/figcaption><\/figure>\n
                      \"Verify
                      Figure 4.67: Verify SSH connection<\/figcaption><\/figure>\n<\/li>\n<\/ol>\n","protected":false},"author":1562,"menu_order":5,"template":"","meta":{"pb_show_title":"on","pb_short_title":"","pb_subtitle":"","pb_authors":[],"pb_section_license":""},"chapter-type":[],"contributor":[],"license":[],"class_list":["post-167","chapter","type-chapter","status-publish","hentry"],"part":97,"_links":{"self":[{"href":"https:\/\/pressbooks.bccampus.ca\/fortigatefirewall\/wp-json\/pressbooks\/v2\/chapters\/167","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pressbooks.bccampus.ca\/fortigatefirewall\/wp-json\/pressbooks\/v2\/chapters"}],"about":[{"href":"https:\/\/pressbooks.bccampus.ca\/fortigatefirewall\/wp-json\/wp\/v2\/types\/chapter"}],"author":[{"embeddable":true,"href":"https:\/\/pressbooks.bccampus.ca\/fortigatefirewall\/wp-json\/wp\/v2\/users\/1562"}],"version-history":[{"count":24,"href":"https:\/\/pressbooks.bccampus.ca\/fortigatefirewall\/wp-json\/pressbooks\/v2\/chapters\/167\/revisions"}],"predecessor-version":[{"id":1123,"href":"https:\/\/pressbooks.bccampus.ca\/fortigatefirewall\/wp-json\/pressbooks\/v2\/chapters\/167\/revisions\/1123"}],"part":[{"href":"https:\/\/pressbooks.bccampus.ca\/fortigatefirewall\/wp-json\/pressbooks\/v2\/parts\/97"}],"metadata":[{"href":"https:\/\/pressbooks.bccampus.ca\/fortigatefirewall\/wp-json\/pressbooks\/v2\/chapters\/167\/metadata\/"}],"wp:attachment":[{"href":"https:\/\/pressbooks.bccampus.ca\/fortigatefirewall\/wp-json\/wp\/v2\/media?parent=167"}],"wp:term":[{"taxonomy":"chapter-type","embeddable":true,"href":"https:\/\/pressbooks.bccampus.ca\/fortigatefirewall\/wp-json\/pressbooks\/v2\/chapter-type?post=167"},{"taxonomy":"contributor","embeddable":true,"href":"https:\/\/pressbooks.bccampus.ca\/fortigatefirewall\/wp-json\/wp\/v2\/contributor?post=167"},{"taxonomy":"license","embeddable":true,"href":"https:\/\/pressbooks.bccampus.ca\/fortigatefirewall\/wp-json\/wp\/v2\/license?post=167"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}