SSL VPN multi-realm

1 Reply

SSL VPN multi-realm

This sample recipe shows how to create a multi-realm SSL VPN that provides different portals for different user groups.

Sample network topology

Sample configuration

WAN interface is the interface connected to ISP. This example shows static mode. You can also use DHCP or PPPoE mode. The SSL VPN connection is established over the WAN interface.

To configure SSL VPN using the GUI:

  1. Configure the interface and firewall address. Port1 interface connects to the internal network.
    1. Go to Network > Interface and edit the wan1
    2. Set IP/Network Mask to 20.120.123/255.255.255.0.
    3. Edit port1 interface and set IP/Network Mask to 168.1.99/255.255.255.0. d. Click OK.
    4. Go to Firewall & Objects > Address and create an address for internet QA_subnet with subnet 192.168.1.0/24 and HR_subnet with subnet 10.1.100.0/24.
  2. Configure user and user group.
    1. Go to User& Device > UserDefinition to create local users qa-user1 and hr-user1.
    2. Go to User& Device > UserGroups to create separate user groups for web-only and full-access portals:
      • QA_group with member qa-user1.
      • HR_group with the member hr-user1.
    3. SSL VPN web portal configuration.
      1. Go to VPN > SSL-VPN Portals to create portal qa-tunnel.
      2. Enable tunnel-mode.
      3. Create a portal hr-web with web-mode enabled.
    4. SSL VPN realms configuration.
      1. Go to System > Feature Visibility to enable SSL-VPN Realms.
      2. Go to VPN > SSL-VPN Realms to create realms for qa and hr.
    5. SSL VPN settings configuration.
      1. Go to VPN > SSL-VPN Settings.
      2. Choose proper Listen on Interface, in this example, wan1.
      3. Listen on Port 10443.
      4. Choose a certificate for ServerCertificate. The default is Fortinet_Factory.
      5. Under Authentication/Portal Mapping, set default Portal Web-access for All OtherUsers/Groups.
      6. Create new Authentication/Portal Mapping for group QA_group mapping portal qa-tunnel.
      7. Specify realm with qa.
      8. Add another entry for group HR_group mapping portal hr-web.
      9. Specify realm with hr.
    6. SSL VPN firewall policy configuration.
      1. Go to Policy & Objects > IPv4 Policy.
      2. Create a firewall policy for QA access.
      3. Fill in the firewall policy name. In this example: QA sslvpn tunnel mode access.
      4. Incoming interface must be SSL-VPN tunnel interface(ssl.root).
      5. Choose an Outgoing Interface. In this example: port1.
      6. Set the source to all and group to QA_group.
      7. In this example, the destination is the internal protected subnet QA_subnet.
      8. Set schedule to always, service to ALL, and Action to Accept.
      9. Click OK.
      10. Create a firewall policy for HR access.
      11. Fill in the firewall policy name. In this example: HR sslvpn web mode access.
      12. Incoming interface must be SSL-VPN tunnel interface(ssl.root).
      13. Choose an Outgoing Interface. In this example: port1.
      14. Set the source to all and group to HR_group.
      15. In this example, the destination is the internal protected subnet HR_subnet.
      16. Set schedule to always, service to ALL, and Action to Accept.
      17. Click OK.

To configure SSL VPN using the CLI:

  1. Configure the interface and firewall address.

config system interface edit “wan1” set vdom “root”

set ip 172.20.120.123 255.255.255.0

next

end

Configure internal interface and protected subnet. Connect Port1 interface to internal network.

config system interface edit “port1” set vdom “root”

set ip 192.168.1.99 255.255.255.0 next

end config firewall address edit “QA_subnet” set subnet 192.168.1.0 255.255.255.0

next edit “HR_subnet” set subnet 10.1.100.0 255.255.255.0

next

end

  1. Configure user and user group.

config user local edit “qa_user1” set type password set passwd your-password

next

end config user group edit “QA_group” set member “qa_user1”

next

end config user local edit “hr_user1” set type password set passwd your-password

next

end config user group edit “HR_group” set member “hr_user1”

next

end

  1. Configure SSL VPN web portal.

config vpn ssl web portal edit “qa-tunnel” set tunnel-mode enable set ip-pools “SSLVPN_TUNNEL_ADDR1” set split-tunneling enable set split-tunneling-routing-address “QA_subnet”

next

end config vpn ssl web portal edit “hr-web” set web-mode enable

next

end

  1. Configure SSL VPN realms.

Using the GUI is the easiest way to configure SSL VPN realms.

  1. Go to System > Feature Visibility to enable SSL-VPN Realms.
  2. Go to VPN > SSL-VPN Realms to create realms for qa and hr.
  1. Configure SSL VPN settings.

config vpn ssl settings set servercert “Fortinet_Factory” set tunnel-ip-pools “SSLVPN_TUNNEL_ADDR1” set tunnel-ipv6-pools “SSLVPN_TUNNEL_IPv6_ADDR1” set source-interface “wan1” set source-address “all” set source-address6 “all” set default-portal “full-access” config authentication-rule edit 1 set groups “QA_group” set portal “qa-tunnel” set realm qa

next edit 2 set groups “HR_group” set portal “hr-web” set realm hr

next

end

  1. Configure SSL VPN firewall policy.

Configure two firewall policies to allow remote QA user to access internal QA network and HR user to access HR network.

config firewall policy edit 1 set name “QA sslvnpn tunnel access” set srcintf “ssl.root” set dstintf “port1” set srcaddr “all” set dstaddr “QA_subnet” set groups “QA_group” set action accept set schedule “always” set service “ALL”

next edit 2 set name “HR sslvpn web access” set srcintf “ssl.root” set dstintf “port1” set srcaddr “all” set dstaddr “HR_subnet” set groups “HR_group” set action accept set schedule “always” set service “ALL”

next

end

To see the results for QA user:

  1. Download FortiClient from forticlient.com.
  2. Open the FortiClient Console and go to Remote Access.
  3. Add a new connection.

l Set VPN Type to SSL VPN. l Set Remote Gateway to https://172.20.120.123:10443/qa..

  1. Select Customize Port and set it to 10443.
  2. Save your settings.
  3. Use the credentials you’ve set up to connect to the SSL VPN tunnel.

If the user’s computer has AntiVirus software installed, a connection is established; otherwise FortiClient shows a compliance warning.

  1. After connection, traffic to subnet 168.1.0 goes through the tunnel.
  2. In FGT, go to VPN > Monitor> SSL-VPN Monitor to verify the list of SSL users.
  3. In FGT, go to Log & Report > Traffic Log > Forward Traffic and view the details of the traffic.

To see the results for HR user:

  1. In a web browser, log into the portal https://172.20.120.123:10443/hr using the credentials you’ve set up to connect to the SSL VPN tunnel.
  2. Go to VPN > Monitor> SSL-VPN Monitor to verify the list of SSL users.
  3. Go to Log & Report > Traffic Log > Forward Traffic and view the details of the traffic.
This entry was posted in Administration Guides, FortiGate, FortiOS 6.2 on by .

About Mike

Michael Pruett, CISSP has a wide range of cyber-security and network engineering expertise. The plethora of vendors that resell hardware but have zero engineering knowledge resulting in the wrong hardware or configuration being deployed is a major pet peeve of Michael's. This site was started in an effort to spread information while providing the option of quality consulting services at a much lower price than Fortinet Professional Services. Owns PacketLlama.Com (Fortinet Hardware Sales) and Office Of The CISO, LLC (Cybersecurity consulting firm).

One thought on “SSL VPN multi-realm”

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.