Fortinet Network Router FORTIOS V30 MR7 User Manual

Configuring user accounts and SSL VPN user groups

Configuring firewall policies

Configuring SSL VPN event-logging

SSL VPN host OS patch check

Granting unique access permissions for SSL VPN tunnel user groups

SSL VPN virtual interface (ssl.root)

SSL VPN dropping connections

Comparison of SSL and IPSec VPN technology

The FortiGate unit supports both SSL and IPSec VPN technologies. Each

combines encryption and VPN gateway functions to create private communication

channels over the Internet, which helps to defray physical network costs. Both

enable you to define and deploy network access and firewall policies using a

single management tool. In addition, both support a simple client/user

authentication process (including optional X.509 security certificates). You have

the freedom to use both technologies; however, one may be better suited to the

requirements of your situation.

In general, IPSec VPNs are a good choice for site-to-site connections where

appliance-based firewalls are used to provide network protection, and company

sanctioned client computers are issued to users. SSL VPNs are a good choice for

roaming users who depend on a wide variety of thin-client computers to access

enterprise applications and/or company resources from a remote location.

SSL and IPSec VPN tunnels may operate simultaneously on the same FortiGate

unit.

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Comparison of SSL and IPSec VPN technology

Configuring a FortiGate SSL VPN

Legacy versus web-enabled applications

IPSec is well suited to network-based legacy applications that are not web-based.

As a layer 3 technology, IPSec creates a secure tunnel between two host devices.

IP packets are encapsulated by the VPN client and server software running on the

hosts.

SSL is typically used for secure web transactions in order to take advantage of

web-enabled IP applications. After a secure HTTP link has been established

between the web browser and web server, application data is transmitted directly

between selected client and server applications through the tunnel.

Authentication differences

IPSec is a well-established technology with robust features that support many

legacy products such as smart cards and biometrics.

SSL supports sign-on to a web portal front-end, from which a number of different

enterprise applications may be accessed. The Fortinet implementation enables

you to assign a specific port for the web portal and to customize the login page if

desired.

Connectivity considerations

IPSec supports multiple connections to the same VPN tunnel—a number of

remote VPN devices effectively become part of the same network.

SSL forms a connection between two end points such as a remote client and an

enterprise network. Transactions involving three (or more) parties are not

supported because traffic passes between client and server applications only.

Relative ease of use

Although managing IPSec VPNs has become easier, configuring SSL VPNs is

simple in comparison. IPSec protocols may be blocked or restricted by some

companies, hotels, and other public places, whereas the SSL protocol is usually

unrestricted.

Client software requirements

Dedicated IPSec VPN software must be installed on all IPSec VPN peers and

clients and the software has to be configured with compatible settings.

To access server-side applications with SSL VPN, the remote user must have a

web browser (Internet Explorer, Netscape, or Mozilla/Firefox), and if Telnet//RDP

are used, Sun Java runtime environment. Tunnel-mode client computers must

also have ActiveX (IE) or Java Platform (Mozilla/Firefox) enabled.

Access control

IPSec VPNs provide secure network access only. Access to the network

resources on a corporate IPSec VPN can be enabled for specific IPSec peers

and/or clients. The amount of security that can be applied to users is limited.

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring a FortiGate SSL VPN

SSL VPN modes of operation

SSL VPNs provide secure access to certain applications. Web-only mode

provides remote users with access to server applications from any thin client

computer equipped with a web browser. Tunnel-mode provides remote users with

the ability to connect to the internal network from laptop computers as well as

airport kiosks, Internet cafes, and hotels. Access to SSL VPN applications is

controlled through user groups.

Session failover support

In a FortiGate high availability (HA) cluster with session pickup enabled, session

failover is supported for IPSec VPN tunnels. After an HA failover, IPSec VPN

tunnel sessions will continue with no loss of data.

Session failover is not supported by SSL VPN tunnels, however cookie failover is

supported for communication between the SSL VPN client and the FortiGate unit.

This means that after a failover, the SSL VPN client can re-establish the SSL VPN

session without having to authenticate again. However, all sessions inside the

SSL VPN tunnel with resources behind the FortiGate unit will stop, and will

therefore have to be restarted.

SSL VPN modes of operation

When a remote client connects to the FortiGate unit, the FortiGate unit

authenticates the user based on user name, password, and authentication

domain. A successful login determines the access rights of remote users

according to user group. The user group settings specify whether the connection

will operate in web-only mode (see “Web-only mode” on page 15) or tunnel mode

(see “Tunnel mode” on page 17).

You can enable a client integrity checker to scan the remote client. The integrity

checker probes the remote client computer to verify that it is “safe” before access

is granted. Security attributes recorded on the client computer (for example, in the

Windows registry, in specific files, or held in memory due to running processes)

are examined and uploaded to the FortiGate unit.

You can enable a cache cleaner to remove any sensitive data that would

otherwise remain on the remote computer after the session ends. For example, all

cache entries, browser history, cookies, encrypted information related to user

authentication, and any temporary data generated during the session are

removed from the remote computer. If the client’s browser cannot install and run

the cache cleaner, the user is not allowed to access the SSL-VPN portal.

Web-only mode

Web-only mode provides remote users with a fast and efficient way to access

server applications from any thin client computer equipped with a web browser.

Web-only mode offers true clientless network access using any web browser that

has built-in SSL encryption and the Sun Java runtime environment.

Support for SSL VPN web-only mode is built into the FortiOS operating system.

The feature comprises an SSL daemon running on the FortiGate unit, and a web

portal, which provides users with access to network services and resources

including HTTP/HTTPS, telnet, FTP, SMB/CIFS, VNC, RDP and SSH.

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

SSL VPN modes of operation

Configuring a FortiGate SSL VPN

In web-only mode, the FortiGate unit acts as a secure HTTP/HTTPS gateway and

authenticates remote users as members of a user group. After successful

authentication, the FortiGate unit redirects the web browser to the web portal

home page and the user can access the server applications behind the FortiGate

unit.

Configuring the FortiGate unit involves selecting web-only-mode access in the

user group settings and enabling the feature through SSL VPN configuration

settings. The user group settings determine which server applications can be

accessed. SSL encryption is used to ensure traffic confidentiality.

Web-only mode client requirements

The remote client computer must be equipped with the following software:

•

Microsoft Windows 2000/XP/2003/Vista, Linux, MacOS X, or UNIX operating

system

Microsoft Internet Explorer 6.0 (or later), Netscape Navigator 7.0 (or later),

Mozilla Foundation/Firefox 1.5 (or later), or Apple Safari 1.3 (or later)

If Telnet/ or RDP are used, Sun Java runtime environment 1.4 (or later), with

Java applet access, JavaScript access, and enabled cookie acceptance

Note: Web browsers offer different SSL security capabilities. The FortiGate unit offers an

SSL version 2 option through the CLI if required to support older browsers. In addition, the

FortiGate unit supports a range of cipher suites for negotiating SSL communications with a

variety of web browsers. The web browser must at least support a 64-bit cipher length.

Tunnel mode

Tunnel mode offers remote users the freedom to connect to the internal network

using the traditional means of web-based access from laptop computers, as well

as from airport kiosks, hotel business centers, and Internet cafés. If the

applications on the client computers used by your user community vary greatly,

you can deploy a dedicated SSL VPN client to any remote client through its web

browser. The SSL VPN client encrypts all traffic from the remote client computer

and sends it to the FortiGate unit through an SSL VPN tunnel over the HTTPS link

between the web browser and the FortiGate unit. Also available is split tunneling,

which ensures that only the traffic for the private network is sent to the SSL VPN

gateway. Internet traffic is sent through the usual unencrypted route. This

conserves bandwith and alleviates bottlenecks.

In tunnel mode, remote clients connect to FortiGate unit and the web portal login

page using Microsoft Internet Explorer, Mozilla Foundation/Firefox, MacOS, or

Linux. The FortiGate unit acts as a secure HTTP/HTTPS gateway and

authenticates remote users as members of a user group. After successful

authentication, the FortiGate unit redirects the web browser to the web portal

home page. The user can then download the SSL VPN client (an ActiveX or Java

plugin) and install it using controls provided through the web portal. SSL VPN

tunnel mode can also be initiated from a standalone application on

Windows/MacOS, and Unix.

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring a FortiGate SSL VPN

Topology

When the user initiates a VPN connection with the FortiGate unit through the SSL

VPN client, the FortiGate unit establishes a tunnel with the client and assigns the

client a virtual IP address from a range of reserved addresses. The client uses the

assigned IP address as its source address for the duration of the connection. After

the tunnel has been established, the user can access the network behind the

FortiGate unit.

Configuring the FortiGate unit to establish a tunnel with remote clients involves

selecting tunnel-mode access in the user group settings and enabling the feature

through SSL VPN configuration settings. The firewall policy and protection profiles

on the FortiGate unit ensure that inbound traffic is screened and processed

securely.

Tunnel-mode client requirements

The remote computer must be equipped with the following software:

•

Microsoft Windows 2000/XP/2003 or Vista (32 or 64-bit), MacOS X v10.3.9,

v10.4 “Tiger”, v10.5 “Leopard”, or Linux Distributions RedHat/Fedora,

Ubuntu/Debian, or Suse

•

Microsoft Internet Explorer 6.0 (or later) with ActiveX enabled, or Mozilla

Foundation/Firefox (1.5 or later) with Java Platform enabled

Note: The browser requirements only apply if you use the tunnel mode client on Windows

through the browser interface. You do not need a browser if you use the standalone tunnel

client.

Note: The user account used to install the SSL VPN client on the remote computer must

have administrator privileges.

Topology

In the most common Internet scenario, the remote client connects to an ISP that

offers connections with dynamically assigned IP addresses. The ISP forwards

packets from the remote client to the Internet, where they are routed to the public

interface of the FortiGate unit.

At the FortiGate unit, you configure user groups and firewall policies to define the

server applications and IP address range or network that remote clients will be

able to access behind the FortiGate unit.

For example, Figure 1 shows a FortiGate gateway (FortiGate_1) to two private

networks, Subnet_1 and Subnet_2.

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Topology

Configuring a FortiGate SSL VPN

Figure 1: Example SSL VPN configuration

Subnet_1

172.16.10.0/24

Remote client

Internet

HTTP/HTTPS

172.16.10.2

wan1

Telnet

172.16.10.3

FortiGate_1

dmz

172.16.10.1

internal

192.168.22.1

FTP

172.16.10.4

SMB/CIFS

172.16.10.5

Subnet_2

192.168.22.0/24

To provide remote clients with access to all of the servers on Subnet_1 from the

Internet, you would configure FortiGate_1 as follows:

•

Create an SSL VPN user group and include the remote users in the user

group. When you create the user group, you also specify whether the users

may access the web portal in web-only mode or tunnel mode.

•

For tunnel-mode users, define the virtual IP addresses that the FortiGate unit

is to assign to remote clients when they connect.

•

Create a firewall destination IP address of 172.16.10.0/24.

Create a firewall policy to allow the SSL VPN user group members to connect

to Subnet_1 through the VPN. For more information, see “Configuring firewall

policies” on page 45.

If your user community needs access to Subnet_2, you would create a second

firewall destination IP address of 192.168.22.0/24and create a second

firewall policy that binds the associated remote clients to the Subnet_2 destination

address.

Infrastructure requirements

•

The FortiGate unit must be operating in NAT/Route mode and have a static

public IP address.

The ISP assigns IP addresses to remote clients before they connect to the

FortiGate unit.

If the remote clients need web-only mode access, see “Web-only mode client

requirements” on page 16.

If the remote clients need tunnel-mode access, see “Tunnel-mode client

requirements” on page 18.

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring a FortiGate SSL VPN

Configuration overview

Before you begin, install your choice of HTTP/HTTPS, telnet, SSH, FTP,

SMB/CIFS, VNC, and/or RDP server applications on the internal network. As an

alternative, these services may be accessed remotely through the Internet. All

services must be running. Users must have individual user accounts to access the

servers (these user accounts are not related to FortiGate user accounts or

FortiGate user groups).

To configure FortiGate SSL VPN technology, you should follow these general

steps:

Enable SSL VPN connections and set the basic options needed to support SSL

VPN configurations. See “Configuring SSL VPN settings” on page 36.

To use X.509 security certificates for authentication purposes, load the signed

server certificate, CA root certificate, and Certificate Revocation List (CRL) onto

the FortiGate unit, and load the personal/group certificates onto the remote

clients. For more information, see the FortiGate Certificate Management User

Guide.

Create one FortiGate user account for each remote client, and assign the users to

SSL VPN type user groups. See “Configuring user accounts and SSL VPN user

groups” on page 42.

Configure the firewall policy and the remaining parameters needed to support the

required mode of operation:

•

For web-only mode operation, see “Configuring Web-only firewall policies” on

page 46.

•

For tunnel-mode operation, see “Configuring tunnel-mode firewall policies” on

page 48.

Define SSL VPN event-logging parameters. See “Configuring SSL VPN event-

logging” on page 50.

You can also monitor active SSL VPN sessions. See “Monitoring active SSL VPN

sessions” on page 51.

Configuring the SSL VPN client

There are several configurations of SSL VPN applications available. The SSL

VPN tunnel client application installs a network driver on the client machine that

redirects all network traffic through the SSL VPN tunnel (it is necessary for the

driver to be OS-specific).

SSL VPN web-mode works on all OSs and browsers. The tunnel mode client can

be downloaded and installed from the browser interface on Windows platforms

through ActiveX for IE, or Firefox plug-ins. If you prefer not to initiate the tunnel

mode client function using a browser, standalone SSL VPN tunnel client

applications are available for Windows, Linux, and MacOS (see Tunnel-mode

client requirements for the specific versions that are supported). When a system

configuration must involve more secure disposal of cached data, the SSL VPN

Virtual Desktop should be used. (Windows XP only).

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the SSL VPN client

Configuring a FortiGate SSL VPN

SSL VPN Virtual Desktop application.

The virtual desktop application creates a virtual desktop on a user's PC and

monitors the data read/write activity of the web browser running inside the virtual

desktop. When the application starts, it presents a ‘virtual desktop’ to the user.

The user starts the web browser from within the virtual desktop and connects to

the ssl vpn web portal. The browser file/directory operation is redirected to a new

location, and the data is encrypted before it is written to the local disk. When the

virtual desktop application exits normally, all the data written to the disk is

removed. If the session terminates abnormally (power loss, system failure), the

data left behind is encrypted and unusable to the user. The next time you start the

virtual desktop, the encrypted data is removed.

Using the SSL VPN Virtual Desktop

On the FortiGate unit GUI under SSL VPN User Group Options, the 'Require

Virtual Desktop Connection' option is not selected by default. If you choose to use

the SSL VPN virtual desktop option, users are forced to use the virtual desktop to

initiate a SSL VPN session. The user must install the FortiClient SSL VPN virtual

desktop application on the client machine and run it. If a user attempts to establish

a VPN connection that does not use the virtual desktop, the connection is refused.

The most recent version of the SSL VPN virtual desktop application can be found

at:

http://support.fortinet.com/

Windows XP is supported in the current release.

To download and run the SSL VPN Virtual Desktop application

Go to the Fortinet Technologies home page at http://support.fortinet.com/ and

select Support.

Under Support, enter your user name and password.

This takes you to the Fortinet customer support site.

Select Firmware Images and then FortiGate.

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring a FortiGate SSL VPN

Configuring the SSL VPN client

The FortiGate index page opens.

Select v3.0 and then MR7.

This takes you to the page with firmware images for MR7.

Select SSL VPN Clients.

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the SSL VPN client

Configuring a FortiGate SSL VPN

To download the SSL VPN Virtual Desktop, select

SSLVPNVirtualDesktopSetup_3.0.384.exeand follow the InstallShield

Wizard instructions.

Figure 2: FortiClient SSL VPN InstallShield Wizard welcome screen

To run the SSL VPN Virtual Desktop application, select Start > All Programs >

FortiNet > SSL VPN Virtual Desktop > SSL VPN Virtual Desktop.

The FortiGate unit may offer you a self-signed security certificate. If you are

prompted to proceed, select Yes.

When you are prompted for your user name and password:

•

In the Name field, type your user name.

In the Password field, type your password.

Select Login.

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring a FortiGate SSL VPN

Configuring the SSL VPN client

The FortiGate unit will redirect your web browser to the FortiGate SSL VPN

Remote Access Web Portal home page automatically.

The fields in the Tools area enable you to specify the URL or IP address of a host

computer. If required, you can ping a host computer behind the FortiGate unit to

verify connectivity to that host.

To connect to a web server from the Tools area

In the Connect to Web Server field, type the URL of the web server (for example,

http://www.mywebexample.co mor https://172.20.120.101).

Select Go.

The FortiGate unit replaces the URL with

https://<FG_IP_address>:<port_no>/proxy/http/<specified_URL> and

the requested page is displayed.

To end the session, close the browser window.

To ping a host or server behind the FortiGate unit

In the Test for Reachability (Ping) field, type the IP address of the host or server

that you want to reach (for example, 192.168.12.22).

Select Go.

A message stating whether the IP address can be reached or not is displayed.

Using the SSL VPN standalone tunnel clients

SSL VPN standalone tunnel client applications are available for Windows, Linux,

and MacOS systems (see Tunnel-mode client requirements for the specific

versions that are supported). There are separate download files for each

operating system.

The most recent version of the SSL VPN standalone client applications can be

found at:

http://support.fortinet.com/

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the SSL VPN client

Configuring a FortiGate SSL VPN

To download the SSL VPN standalone tunnel client (Windows)

Go to the Fortinet Technologies home page at http://support.fortinet.com/ and

select Support.

Under Support, enter your user name and password.

This takes you to the Fortinet customer support site.

Select Firmware Images and then FortiGate.

Figure 3: Firmware Images selection on Fortinet customer support site

The FortiGate index page opens.

Figure 4: FortiGate index page

Select v3.0 and then MR7.

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring a FortiGate SSL VPN

Configuring the SSL VPN client

This takes you to the page with firmware images for MR7.

Select SSL VPN Clients.

To download the SSL VPN Windows client application, select

FortiClientSSLVPNSetup_3.0.384.exeor

FortiClientSSLVPN_3.0_384.msiand follow the InstallShield Wizard

instructions.

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the SSL VPN client

Configuring a FortiGate SSL VPN

To use the SSL VPN standalone tunnel client (Windows)

Go to Start > All Programs > Fortinet > FortiClient SSL VPN >

FortiClient SSL VPN.

Server Address

Username

Enter the IP address of the server you need to access.

Enter your user name.

Password

Enter the password associated with your user account.

Expand button

Select to expand the dialog box and display Client Certificate,

Save user name and password, and Keep connection alive

until manually stopped.

Client Certificate

Select the authentication certificate from the drop-down list, if

required.

Save user name and Select to save the value in Username and Password for future

logins.

password

Keep connection

alive until manually

stopped

Select to have the connection stay up until you log out.

Select Connect.

To manually terminate the connection, select Exit.

To uninstall the SSL VPN standalone tunnel client (Windows)

Go to Start > Control Panel.

Select Add or Remove Programs.

Select ‘FortiClient SSL VPN’ and then Remove.

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring a FortiGate SSL VPN

Configuring the SSL VPN client

To download the SSL VPN standalone tunnel client (Linux)

Go to the Fortinet Technologies home page at http://support.fortinet.com/ and

select Support.

Under Support, enter your user name and password.

This takes you to the Fortinet customer support site.

Select Firmware Images and then FortiGate.

The FortiGate index page opens.

Select v3.0 and then MR7.

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the SSL VPN client

Configuring a FortiGate SSL VPN

This takes you to the page with firmware images for MR7.

Select SSL VPN Clients.

To download the SSL VPN standalone tunnel client (Linux), select

forticlientsslvpn_linux_3.0.384.tar.gz, extract the package file to a folder and run

the client program ‘forticlientsslvpn’.

When you run the install program for the first time, you will have to set up system

parameters (root privileges) before you run the program or before other users without

administrator privileges can use the application.

In the First Run dialog, select OK.

The command line terminal window opens.

Type your password and select Enter.

The License Agreement dialog appears in the command line terminal window.

Accept the License Agreement, and select Enter.

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring a FortiGate SSL VPN

Configuring the SSL VPN client

The FortiClient SSL VPN tunnel client (Linux) opens.

After this initial setup is complete, a user with a normal (non-administrator)

account can establish a SSL VPN tunnel session.

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the SSL VPN client

Configuring a FortiGate SSL VPN

To use the SSL VPN standalone tunnel client (Linux)

Go to the folder that you downloaded the Linux tunnel client application into, and

double-click on ‘forticlientsslvpn’.

The FortiClient SSL VPN tunnel client (Linux) opens.

Server

Enter the IP address of the server you need to access.

Enter your user name.

User

Password

Advanced settings

Enter the password associated with your user account.

Save user name

and password

Select to save the value in User and Password for future logins.

Select to have the connection stay up until you log out.

Keep connection

alive until manually

stopped

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring a FortiGate SSL VPN

Configuring the SSL VPN client

Use Client

Certificate (A PKCS

#12 File)

File Path

Enter the path to the certificate file, or browse

to the location of the file.

File Password

Enter the password associated with the

certificate file.

Use Proxy

Proxy

Select to make it necessary for the user to utilize a proxy server.

Enter the IP address of the proxy server and the port identifier.

Enter the user name of the client using the proxy server.

Enter the user password for the client to access the proxy server.

Initiate the SSL VPN tunnel connection.

User

Password

Connect

To uninstall the SSL VPN standalone tunnel client (Linux)

Remove/delete the folder containing all the SSL VPN client application files.

To download the SSL VPN standalone tunnel client (MacOS)

Go to the Fortinet Technologies home page at http://support.fortinet.com/ and

select Support.

Under Support, enter your user name and password.

This takes you to the Fortinet customer support site.

Select Firmware Images and then FortiGate.

The FortiGate index page opens.

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring the SSL VPN client

Configuring a FortiGate SSL VPN

Select v3.0 and then MR7.

This takes you to the page with firmware images for MR7.

Select SSL VPN Clients.

To download the SSL VPN MacOS client application, double-click on the client file

forticlientsslvpn_macosx_3.0.384.dmg.

The Mac mounts the disk image as ‘forticlientsslvpn’.

Double-click the forticlientsslvpn.pkg file inside the disk image and follow the

instructions.

The application installs the program ‘forticlientsslvpn’ in the Applications

folder

Unmount the disk image by selecting the disk image file

‘forticlientsslvpn_macos_3.0.nnn.dmg’ and dragging it into the Trash

(nnnrefers to the build number).

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring a FortiGate SSL VPN

Configuring the SSL VPN client

To use the SSL VPN standalone tunnel client (MacOS)

Go to the Applications folder and double-click on forticlientsslvpn.

The FortiClient SSL VPN tunnel client (MacOS) opens.

To uninstall the SSL VPN standalone tunnel client (MacOS)

In the Applications folder, select ‘forticlientsslvpn’ and drag it into the

Trash.

After you empty the Trash folder, the installed program is removed from the user

computer.

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring SSL VPN settings

Configuring a FortiGate SSL VPN

Configuring SSL VPN settings

You can configure and manage the FortiGate unit through a secure HTTP

(HTTPS) connection from any computer running a web browser. For information

about how to connect to the web-based manager, see “Connecting to the web-

based manager” in the FortiGate Installation Guide.

Note: As an alternative, you can connect the management computer to the Console

connector of the FortiGate unit directly using a serial cable and configure the FortiGate unit

through the Command Line Interface (CLI). The CLI can also be launched from within the

web-based manager. For more information, see “Connecting to the FortiGate console” in

the FortiGate CLI Reference.

Refer to the FortiGate Installation Guide and FortiGate Administration Guide to

change the password, configure the interfaces of the FortiGate unit, and assign

basic operating parameters, including a default gateway.

There are basic administrative tasks common to all modes of operation that must

be completed first, regardless of the connection mode you select.

The VPN > SSL > Config page contains basic SSL VPN settings including idle-

timeout values and SSL encryption preferences for compatibility with various web

browsers. You may also optionally enable authentication through X.509 security

certificates (for more information about security certificates, see the FortiGate

Certificate Management User Guide).

In addition to setting these preferences on the VPN > SSL > Config page, you

may choose to modify the following system settings:

•

The FortiGate unit redirects web browsers to the web portal home page after

the remote client has been authenticated and the user has logged in

successfully. As an option, you can display a second HTML page in a popup

window for all members of a user group. For more information, see

“Redirecting a user group to a popup window” on page 40.

•

You can customize the look of the web portal login page through replacement

messages. For more information, see “Customizing the web portal login page”

on page 41.

Enabling SSL VPN connections and editing SSL VPN settings

To enable SSL VPN connections and configure or edit SSL VPN settings, go to

VPN > SSL > Config and select Enable SSL-VPN. The FortiGate unit does not

accept web-only mode or tunnel-mode connections while SSL VPN operation is

disabled.

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring a FortiGate SSL VPN

Configuring SSL VPN settings

Figure 5: Edit SSL VPN settings

Enable SSL VPN

Tunnel IP Range

Select to enable SSL VPN connections.

Specify the range of IP addresses reserved for tunnel-

mode SSL VPN clients. Type the starting and ending

address that defines the range of reserved IP

addresses. See Specifying an IP address range for

tunnel-mode clients .

Server Certificate

Select the signed server certificate to use for

authentication purposes. If you leave the default setting

(Self-Signed), the FortiGate unit offers its factory

installed (self-signed) certificate from Fortinet to remote

clients when they connect. See Enabling strong

authentication through security certificates .

Require Client Certificate

If you want to enable the use of group certificates for

authenticating remote clients, select the option.

Afterward, when the remote client initiates a connection,

the FortiGate unit prompts the client for its client-side

certificate as part of the authentication process.

Encryption Key Algorithm

See Specifying the cipher suite

for SSL negotiations.

Select the algorithm for creating a secure SSL

connection between the remote client web browser and

the FortiGate unit.

Default - RC4(128

bits) and higher

If the web browser on the remote client is capable of

matching a 128-bit or greater cipher suite, select this

option.

High - AES(128/256

bits) and 3DES

If the web browser on the remote client is capable of

matching a high level of SSL encryption, select this

option to enable cipher suites that use more than 128

bits to encrypt data.

Low - RC4(64 bits),

DES and higher

If you are not sure which level of SSL encryption the

remote client web browser supports, select this option to

enable a 64-bit or greater cipher suite.

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring SSL VPN settings

Configuring a FortiGate SSL VPN

Idle Timeout

Type the period of time (in seconds) to control how long

the connection can remain idle before the system forces

the user to log in again. The range is from 10 to 28800

seconds. This setting applies to the SSL VPN session.

The interface does not time out when web application

sessions or tunnels are up. See Setting the idle timeout

setting.

Portal Message

If you want to display a custom caption at the top of the

web portal home page, type the message. See Adding a

custom caption to the web portal home page.

Advanced (DNS and WINS Servers) See Adding WINS and DNS services for clients.

DNS Server #1

DNS Server #2

Enter up to two DNS Servers to be provided for the use

of clients.

WINS Server #1

WINS Server #2

Enter up to two WINS Servers to be provided for the use

of clients.

When you finish making your selections, select Apply.

Note: The Tunnel IP Range fields are used to configure tunnel-mode access only. If you

are configuring web-only mode operation, leave 0.0.0.0values in the Tunnel IP Range

fields. If you are configuring tunnel-mode operation, see “Specifying an IP address range

for tunnel-mode clients” on page 38. For information about enabling certificate-based

authentication through the Server Certificate and Require Client Certificate options, refer to

the FortiGate Certificate Management User Guide.

Specifying a port number for web portal connections

You can optionally specify a different TCP port number for users to access the

web portal login page through the HTTPS link. By default, the port number is

10443 and users can access the web portal login page using the following default

URL:

https://<FortiGate_IP_address>:10443/remote

where <FortiGate_IP_address> is the IP address of the FortiGate interface that

accepts connections from remote users.

Note: Do not select port number 443 for user access to the web portal login page. Port

number 443 is reserved to support administrative connections to the FortiGate unit through

the web-based manager.

Go to System > Admin > Settings.

In the SSLVPN Login Port field, type an unused port number.

Select Apply.

Specifying an IP address range for tunnel-mode clients

The Tunnel IP Range fields on the VPN > SSL > Config page enable you to

reserve a range of IP addresses for remote SSL VPN clients. After the FortiGate

unit authenticates a request for a tunnel-mode connection, the SSL VPN client

connects to the FortiGate unit and is assigned an IP address from this range.

Afterward, the FortiGate unit uses the assigned address to communicate with the

SSL VPN client.

Caution: Take care to prevent overlapping IP addresses. Do not assign IP addresses that

are already in use on the private network. As a precaution, consider assigning IP

addresses from a network that is not commonly used (for example, 10.254.254.0/24).

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring a FortiGate SSL VPN

Configuring SSL VPN settings

To reserve a range of IP addresses for tunnel-mode clients

Go to VPN > SSL > Config.

In the Tunnel IP Range fields, type the starting and ending IP addresses (for

example, 10.254.254.80to 10.254.254.100).

Select Apply.

Enabling strong authentication through security certificates

The FortiGate unit supports strong (two-factor) authentication through X.509

security certificates (version 1 or 3). Strong authentication can be configured for

SSL VPN user groups by selecting the Server Certificate and Require Client

Certificate options on the VPN > SSL > Config page. However, you must first

ensure that the required certificates have been installed.

To generate certificate requests, install signed certificates, import CA root

certificates and certificate revocation lists, and back up and/or restore installed

certificates and private keys, refer to the FortiGate Certificate Management User

Guide.

Specifying the cipher suite for SSL negotiations

The FortiGate unit supports a range of cryptographic cipher suites to match the

capabilities of various web browsers. The web browser and the FortiGate unit

negotiate a cipher suite before any information (for example, a user name and

password) is transmitted over the SSL link.

Go to VPN > SSL > Config.

In Encryption Key Algorithm, select one of the following options:

•

If the web browser on the remote client is capable of matching a 128-bit or

greater cipher suite, select Default - RC4(128 bits) and higher.

•

If the web browser on the remote client is capable of matching a high level of

SSL encryption, select High - AES(128/256 bits) and 3DES. This option

enables cipher suites that use more than 128 bits to encrypt data.

•

If you are not sure which level of SSL encryption the remote client web

browser supports, select Low - RC4(64 bits), DES and higher. The web

browser must at least support a 64-bit cipher length.

Select Apply.

Setting the idle timeout setting

The idle timeout setting controls how long the connection can remain idle before

the system forces the remote user to log in again. To improve security, keep the

default value of 300 seconds.

Go to VPN > SSL > Config.

In the Idle Timeout field, type an integer value. The valid range is from 10 to

28800 seconds.

Select Apply.

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring SSL VPN settings

Configuring a FortiGate SSL VPN

Setting the client authentication timeout setting

The client authentication timeout setting controls how long an authenticated

connection will remain connected. When this time expires, the system forces the

remote client to authenticate again.

Note: The default value is 1500 seconds. You can only modify this timeout value in the CLI.

For example, to change the authentication timeout to 1800 seconds, enter the

following commands:

config vpn ssl settings

set auth-timeout 1800

end

Adding a custom caption to the web portal home page

You can add a custom caption (maximum 31 characters) to the top of the web

portal home page.

To add a custom caption

Go to VPN > SSL > Config.

In the Portal Message field, type the caption.

Select Apply.

Adding WINS and DNS services for clients

You can specify the WINS or DNS servers that are made available to SSL-VPN

clients.

Go to VPN > SSL > Config.

Select the blue triangle to open the Advanced section.

Enter the IP addresses of one or two DNS Servers to be provided for the use of

clients.

Enter the IP addresses of one or two WINS Servers to be provided for the use of

clients.

Redirecting a user group to a popup window

The FortiGate unit redirects web browsers to the web portal home page after the

remote client has been authenticated and the user has logged in successfully.

As an option, you can have the FortiGate unit display a second HTML page in a

popup window when the client web browser is redirected to the web portal home

page. To support this feature, the level of security settings associated with the

Internet zone in the web browser must be set to permit popup windows.

The following procedure assumes that SSL VPN user groups have been defined

(see “Configuring user accounts and SSL VPN user groups” on page 42). A

different popup window can be specified per user group.

To display a custom popup window for a user group

Go to User > User Group.

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring a FortiGate SSL VPN

Configuring user accounts and SSL VPN user groups

Select the Edit icon in the row that corresponds to the SSL VPN user group.

Expand SSL-VPN User Group Options.

In the Redirect URL field, type the URL of the web page that you want to display in

the popup window.

Select OK.

Customizing the web portal login page

The HTML code making up the web portal login page can be edited. Before you

begin, copy the default text to a separate text file for safe-keeping. Afterward, if

editing produces unexpected results, you can restore the text to the original

version.

To edit the HTML code

Go to System > Config > Replacement Messages.

Expand the SSL VPN row and select the Edit icon that corresponds to the SSL

VPN login message.

Edit the HTML text, subject to the restrictions given in the FortiGate Administration

Guide (see “Changing the authentication login page” in the “System Config”

chapter).

Select OK.

Configuring user accounts and SSL VPN user groups

Remote users must be authenticated before they can request services and/or

access network resources through the web portal. The authentication process

relies on FortiGate user group definitions, which can optionally use established

authentication mechanisms such as RADIUS and LDAP to authenticate remote

clients.

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring user accounts and SSL VPN user groups

Configuring a FortiGate SSL VPN

You can choose to use a plain text password for authentication through the

FortiGate unit (Local domain), forward authentication requests to an external

RADIUS or LDAP server, or utilize PKI certificate authentication. If password

protection will be provided through a RADIUS or LDAP server, you must configure

the FortiGate unit to forward authentication requests to the RADIUS or LDAP

server. In the case of certificate authentication, you must install the required

certificates.

The following procedures explain how to create a user account and user group in

the Local domain. For information about how to create RADIUS, LDAP or PKI

user accounts, refer to the “User” chapter of the FortiGate Administration Guide.

For information about certificate authentication, see the FortiGate Certificate

Management User Guide.

To create a user account in the Local domain

Go to User > Local and select Create New.

User Name

Disable

Type or edit the remote user name (for example, User_1).

Select Disable to prevent this user from authenticating.

Password

Select Password to authenticate this user using a password stored on

the SSL VPN unit.

Type or edit the password to be associated with the user account. The

password should be at least six characters long.

LDAP

Select LDAP to authenticate this user using a password stored on an

LDAP server. Select the LDAP server from the drop-down list.

RADIUS

Select RADIUS to authenticate this user using a password stored on a

RADIUS server. Select the RADIUS server from the drop-down list.

Select OK.

Repeat this procedure for each remote user.

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring a FortiGate SSL VPN

Configuring user accounts and SSL VPN user groups

To create a user group

Go to User > User Group and select Create New.

In the Name field, type a name for the group (for example, Web-only_group).

From the Type drop-down list, select SSL VPN.

One at a time, select user names from the Available Users/Groups list, and select

the right-pointing arrow to move them to the Members list.

Select the blue triangle to expand the SSL-VPN User Group Options.

Select Enable SSL-VPN Tunnel Service if the remote clients associated with the

user group need to establish an SSL VPN tunnel with the FortiGate unit.

Note: If a user has been configured to use tunnel-mode only, when they log in, the tunnel is

brought up automatically. The split tunneling feature is not activated by default, it must be

selected.

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring user accounts and SSL VPN user groups

Configuring a FortiGate SSL VPN

To activate the split tunnel feature, select Enable Split Tunneling. Split tunneling

ensures that only the traffic for the private network is sent to the SSL VPN

gateway. Internet traffic is sent through the usual unencrypted route.

To override the Tunnel IP range defined in VPN > SSL > Config, enter the starting

and ending IP address range for this group in the Restrict tunnel IP range for this

group fields.

Note: If you configure a user group and define Restrict tunnel IP range for this group, the

group range is used in the SSL VPN configuration. If you do not define a range of global IP

addresses, you must define a group range. If you define both IP address ranges, the group

level range is applied to the configuration.

If the user group requires web-only-mode access, select Enable Web Application

and then select the web applications and/or network file services that the user

group needs. The corresponding server applications can be running on the

network behind the FortiGate unit or accessed remotely through the Internet.

To enable client-integrity checking options, select from the following:

•

Check FortiClient AV Installed and Running

Check FortiClient FW Installed and Running

Check for Third Party AV Software

Check for Third Party Firewall Software

Require Virtual Desktop Connection

The client-integrity checking options determine whether the FortiClient™ Host

Security application or other antivirus/firewall applications are running on the client

computer before a tunnel is established. The host-checking function is performed

by the ActiveX/Java Platform control, which is downloaded and installed on the

client computer the first time the client initiates the SSL VPN portal.

Note: The user account used to install the SSL VPN client on the remote computer must

have administrator privileges. If the user account does not have administrator privileges,

the installation will fail (with Windows, there will be no error message with a failed

installation). After the ActiveX or Java Platform control is installed, the client computer can

be used by a user who does not have administrator privileges.

If there are no applications installed and enabled on the client computer, the

connection is refused. T a ble 1 lists the products supported for clients who have

Windows XP SP2. All other systems must have Norton (Symantec) AntiVirus or

McAfee VirusScan software installed and enabled.

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring a FortiGate SSL VPN

Configuring firewall policies

Table 1: AV/Firewall supported product detection

Product

Norton Internet Security 2006

Trend Micro PC-cillin

McAfee

Firewall

Sophos Anti-Virus

Panda Platinum 2006 Internet Security

F-Secure

Secure Resolutions

Cat Computer Services

AhnLab

Kaspersky

ZoneAlarm

Require Virtual Desktop Connection prevents a user from establishing a SSL VPN

session without using the SSL VPN Virtual Desktop application. For more

information, see the SSL VPN User Guide.

To enable the FortiGate unit to remove residual information from the remote client

computer (for example, from the web browser cache) just before the SSL VPN

session ends, select Enable Cache Clean. When this feature is enabled, if the

client’s browser cannot install and run the cache cleaner, the user is not allowed to

access the SSL-VPN portal.

To allow the SSL VPN user group to use a pre-configured bookmark group,

enable Bookmarks and select the bookmark group from the drop-down list.

To have the FortiGate unit display a second HTML page in a popup window when

the web portal home page is displayed, type the URL of the web page into the

Redirect URL field.

To display a custom web portal home page caption for this group, enter the

message in the Customize portal message for this group field.

Note: This custom message overrides the portal message configured in VPN >

SSL > Config.

Select OK.

Configuring firewall policies

This section contains the procedures needed to configure firewall policies for web-

only mode operation and tunnel-mode operation. These procedures assume that

you have already completed the procedures outlined in “Configuring user

accounts and SSL VPN user groups” on page 42.

A firewall policy specifies the originating (source) IP address of a packet and the

destination address defines the IP address of the intended recipient or network.

In general, configuring a firewall policy involves:

•

specifying the IP source and destination addresses

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring firewall policies

Configuring a FortiGate SSL VPN

•

specifying the level of SSL encryption to use and the authentication method

binding the user group to the firewall policy

Note: In tunnel mode, it is necessary to create a DENY firewall policy that immediately

follows the SSL VPN policy. If this policy is not created, SSL VPN tunnels will use other

ACCEPT firewall policies. See the order of the Firewall policies below:

The following topics are included in this section:

•

Configuring firewall addresses

Configuring tunnel-mode firewall policies

Configuring SSL VPN event-logging

in “Configuring user accounts and SSL VPN user groups” on page 42.

Configuring firewall addresses

Configuring the firewall addresses for web-only and tunnel mode connections

involves specifying the IP source/host and destination addresses:

Web-only mode:

•

For the source address, select the predefined address “all” in the firewall

encryption policy to refer to web-only mode clients.

•

The destination address corresponds to the IP address or addresses that

remote clients need to access. The destination address may correspond to

an entire private network (behind the FortiGate unit), a range of private IP

addresses, or the private IP address of a server or host.

Tunnel mode:

•

The source address corresponds to the public IP address that can be

connected to the FortiGate unit. This address is used to restrict who can

access the FortiGate unit.

•

The destination address corresponds to the IP address or addresses that

remote clients need to access. The destination address may correspond to

an entire private network (behind the FortiGate unit), a range of private IP

addresses, or the private IP address of a server or host.

Configuring Web-only firewall policies

To specify the destination IP address

Go to Firewall > Address and select Create New.

In the Address Name field, type a name that represents the local network,

server(s), or host(s) to which IP packets may be delivered (for example,

Subnet_1).

From the Type list, select Subnet/IP Range.

In the Subnet/IP Range field, type the corresponding IP address and subnet mask

(for example, 172.16.10.0/24).

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring a FortiGate SSL VPN

Configuring firewall policies

Note: To provide access to a single host or server, you would type an IP address like

172.16.10.2/32. To provide access to two servers having contiguous IP addresses, you

would type an IP address range like 172.16.10.[4-5].

Select OK.

To define the firewall policy for web-only mode connections

Go to Firewall > Policy and select Create New.

Enter these settings in particular:

Source

Interface/Zone

Select the FortiGate interface that accepts connections from remote

users.

Address Name

Select all.

Destination

Interface/Zone

Select the FortiGate interface to the local private network (for example,

dmz).

Address Name

Select the IP destination address that you defined previously (for

example, Subnet_1).

Service

Action

Select ANY.

Select SSL-VPN.

SSL Client

Certificate

Restrictive

Select to allow traffic generated by holders of a (shared) group

certificate, for example, a user group containing PKI peers/users. The

holders of the group certificate must be members of an SSL VPN user

group, and the name of that user group must be present in the Allowed

list.

Cipher Strength Select one of the following options to determine the level of SSL

encryption to use. The web browser on the remote client must be

capable of matching the level that you select:

• To use any cipher suite, select Any.

• To use a 164-bit or greater cipher suite, select High >= 164.

• To use a 128-bit or greater cipher suite, select Medium >= 128.

User

Authentication

Method

Select one of the following options to bind user groups to authentication

methods:

• If the user group contains only local users, select Local.

• If the remote clients will be authenticated by an external RADIUS

server, select Radius.

• If the remote clients will be authenticated by an external LDAP server,

select LDAP.

• If the user group contains Local, RADIUS, and LDAP users, select

Any to enable all of the authentication methods. Local is attempted

first, then RADIUS, then LDAP.

Available

Groups

Select the name of the user group requiring SSL VPN access, and then

select the right-pointing arrow. Do not select more than one user group

unless all members of the selected user groups have identical access

requirements.

Select OK.

If the user group requires access to another server or network, create the IP

destination address (see “T o s pecify the destination IP address” on page 46) and

repeat this procedure to create the required firewall policy.

Create additional IP destination addresses and firewall policies if required for

each additional user group.

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring firewall policies

Configuring a FortiGate SSL VPN

Configuring tunnel-mode firewall policies

Follow the procedures in this section to complete a tunnel-mode configuration.

These procedures assume that you have already completed the procedures found

When a remote client initiates a connection to the FortiGate unit, the FortiGate

unit authenticates the client and determines which mode of operation is in effect

for the user. When tunnel mode is enabled, the user can access the server

applications and network services on the internal network if required and/or

download and install an ActiveX plugin from the web portal. The ActiveX control

provides SSL VPN client software.

Note: On the web browser, ensure that the security settings associated with the Internet

zone permit ActiveX controls to be downloaded and run.

After the user adds the ActiveX plugin to the web browser on the remote client, the

user can start the SSL VPN client software to initiate an SSL VPN tunnel with the

FortiGate unit. The FortiGate unit establishes the tunnel with the SSL client and

assigns the client a virtual IP address. Afterward, the SSL client uses the assigned

virtual IP address as its source address for the duration of the session.

To configure the FortiGate unit to support tunnel-mode access, you perform the

following configuration tasks on the FortiGate unit:

•

Specify the IP address(es) that can be assigned to the SSL VPN client when

they establish tunnels with the FortiGate unit.

•

Define a firewall policy to support tunnel-mode operations.

A firewall policy specifies the originating (source) IP address of a packet and the

destination address defines the IP address of the intended recipient or network. In

this case, the source address corresponds to the IP address of the remote user

that will connect to the FortiGate unit, and the destination address corresponds to

the IP address(es) of the host(s), server(s), or network behind the FortiGate unit.

Configuring the firewall policy involves:

•

specifying the source and destination IP addresses:

•

The source address corresponds to the IP address of the remote user.

The destination address corresponds to the IP address or addresses that

remote clients need to access. The destination address may correspond to

an entire private network, a range of private IP addresses, or the private IP

address of a server or host.

•

specifying the level of SSL encryption to use and the authentication method

binding the user group to the firewall policy

Note: If your destination address, SSL encryption, and user group are the same

as for your web-only mode connection, you do not need to create a firewall policy

for tunnel mode. The FortiGate unit uses the web-only mode policy settings

except for the source address range, which it obtains from the tunnel IP range

settings.

To specify the source IP address

Go to Firewall > Address and select Create New.

In the Address Name field, type a name that represents the IP address that is

permitted to set up SSL VPN connection.

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring a FortiGate SSL VPN

Configuring firewall policies

From the Type list, select Subnet/IP Range.

In the Subnet/IP Range field, type the corresponding IP address and subnet mask

(for example, 172.16.10.0/24). If the remote client’s IP address is unknown,

the Subnet/IP Range should be “all”, with 0.0.0.0/0.0.0.0 as the address used.

Note: To provide access to a single host or server, you would type an IP address like

172.16.10.2/32. To provide access to two servers having contiguous IP addresses, you

would type an IP address range like 172.16.10.[4-5].

In the Interface field, select the interface to the internal (private) network.

Select OK.

To specify the destination IP address

Go to Firewall > Address and select Create New.

In the Address Name field, type a name that represents the local network,

server(s), or host(s) to which IP packets may be delivered (for example,

Subnet_2).

In the Subnet/IP Range field, type the corresponding IP address (for example,

192.168.22.0/24for a subnet, or 192.168.22.2/32for a server or host), or

IP address range (192.168.22.[10-25]).

In the Interface field, select the interface to the external (public) network.

Select OK.

To define the firewall policy for tunnel-mode operations

Go to Firewall > Policy and select Create New.

Enter these settings:

Source

Interface/Zone

Select the FortiGate interface that accepts connections from

remote users (for example, external).

Address Name

Select the name that corresponds to the IP address of the remote

user.

Destination

Interface/Zone

Select the FortiGate interface to the local private network (for

example, internal).

Address Name

Select the IP destination address that you defined previously for

the host(s), server(s), or network behind the FortiGate unit (for

example, Subnet_2).

Service

Action

Select ANY.

Select SSL-VPN.

SSL Client Certificate Select to allow traffic generated by holders of a (shared) group

certificate, for example, a user group containing PKI peers/users.

The holders of the group certificate must be members of an SSL

VPN user group, and the name of that user group must be present

in the Allowed field.

Restrictive

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring SSL VPN event-logging

Configuring a FortiGate SSL VPN

Cipher Strength

Select one of the following options to determine the level of SSL

encryption to use. The web browser on the remote client must be

capable of matching the level that you select:

• To use any cipher suite, select Any.

• To use a 164-bit or greater cipher suite, select High >= 164.

• To use a 128-bit or greater cipher suite, select Medium >= 128.

User Authentication Select one of the following options to bind user groups to

authentication methods:

Method

• If the user group contains only local users, select Local.

• If the remote clients will be authenticated by an external

RADIUS server, select Radius.

• If the remote clients will be authenticated by an external LDAP

server, select LDAP.

• If the user group contains Local, RADIUS, and LDAP users,

select Any to enable all of the authentication methods. Local is

attempted first, then RADIUS, then LDAP.

Available Groups

Select the name of the user group requiring SSL VPN access, and

then select the right-pointing arrow. Do not select more than one

user group unless all members of the selected user groups have

identical access requirements.

Select OK.

Note: If you apply a protection profile in a SSL VPN firewall policy, it will only apply to

tunnel-mode operations.

If the user group requires access to another server or network, create the IP

destination address (see “T o s pecify the destination IP address” on page 46) and

repeat this procedure to create the required firewall policy.

Create additional IP destination addresses and firewall policies if required for each

additional user group.

Configuring SSL VPN event-logging

You can configure the FortiGate unit to log SSL VPN events. For information

about how to interpret log messages, see the FortiGate Log Message Reference.

To log SSL VPN events

Go to Log&Report > Log Config > Log Setting.

Enable the storage of log messages to one or more of the following locations:

•

a FortiAnalyzer unit

the FortiGate system memory

a remote computer running a syslog server

Note: If available on your FortiGate unit, you can enable the storage of log messages to a

system hard disk. In addition, as an alternative to the options listed above, you may choose

to forward log messages to a remote computer running a WebTrends firewall reporting

server. For more information about enabling either of these options through CLI commands,

see the “log” chapter of the FortiGate CLI Reference.

If the options are concealed, select the blue arrow beside each option to reveal

and configure associated settings.

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring a FortiGate SSL VPN

Monitoring active SSL VPN sessions

If logs will be written to system memory, from the Log Level list, select Information.

For more information, see the “Log & Report” chapter of the FortiGate

Administration Guide.

Select Apply.

To filter SSL VPN events

Go to Log&Report > Log Config > Event Log.

Select Enable, and then select one or more of the following options:

•

SSL VPN user authentication event

SSL VPN administration event

SSL VPN session event

Select Apply.

To view SSL VPN event logs

Go to Log&Report > Log Access.

If the option is available from the Type list, select the log file from disk or memory.

You can modify the settings in the top row to meet your requirements. Log

messages are displayed beneath the top row.

Monitoring active SSL VPN sessions

You can display a list of all active SSL VPN sessions. The list displays the user

name of the remote user, the IP address of the remote client, and the time that the

connection was made. The list also identifies which services are being provided

(see Figure 6).

To view the list of active sessions, go to VPN > SSL > Monitor.

Figure 6: Monitor list: Web-only mode connections

No.

The identifier of the connection.

User

The user names of all connected remote users.

The IP addresses of the host devices connected to the FortiGate unit.

The starting time of each connection.

Source IP

Begin Time

Description

Information about which services are being provided.

When a tunnel-mode user is connected, the Description field displays the IP

address that the FortiGate unit assigned to the remote host (see Figure 7).

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring SSL VPN bookmarks and bookmark groups

Configuring a FortiGate SSL VPN

Figure 7: Monitor list: Tunnel-mode connection

Delete

If required, you can end a session/connection by selecting the Delete button in the

row that corresponds to the connection.

Configuring SSL VPN bookmarks and bookmark groups

If you create a user account that permits web-only mode access, you can create

hyperlinks to frequently accessed server applications that the user can use to start

any session from the home page through the hyperlinks. The FortiGate unit

forwards client requests to servers on the Internet or internal network. To use the

web-portal applications, you add the URL, IP address, or name of the server

application to the Bookmarks list. The bookmarks are available when the user

starts an active SSL VPN session.

Viewing the SSL VPN bookmark list

You can display a list of all existing SSL VPN bookmarks created using the

FortiGate unit. The list details the name of the bookmark, type of bookmark, and

the link details.

To view the list of predefined SSL VPN bookmarks, go to VPN > SSL >

Bookmark.

Figure 8: Bookmark list

Delete

Edit

Bookmark Name The type/names of links to remote server applications and network

services.

Link

The URL, host, or folder of the bookmark link.

Delete or edit an entry in the list.

Delete and Edit

icons

See also

•

Configuring SSL VPN bookmarks

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring a FortiGate SSL VPN

Configuring SSL VPN bookmarks and bookmark groups

•

Viewing the SSL VPN Bookmark Groups list

Configuring SSL VPN bookmark groups

Configuring SSL VPN bookmarks

Go to VPN > SSL > Bookmark and select Create New to create hyperlinks to

frequently accessed server applications.

Figure 9: Create New Bookmark

Bookmark Name Type the text to display in the hyperlink. The name is displayed in the

Bookmarks list.

Application Type Select the abbreviated name of the server application or network

service from the drop-down list:

•

Web

Telnet

FTP

SMB/CIFS

VNC

RDP

SSH

URL/Host/Folder Type the information that the FortiGate unit needs to forward client

requests to the correct server application or network service:

•

If the application type is Web, type the URL of the web server (for

example, www.fortinet.com).

If the application type is Telnet, type the IP address of the telnet

host (for example, 10.10.10.10).

If the application type is FTP, type the IP address of the FTP host

as a root directory/folder (for example, //server/folder/).

If the application type is SMB/CIFS, type the IP address of the SMB

host and the root directory/folder associated with your account (for

example, //server/folder/).

•

If the application type is VNC, type the IP address of the host (for

example, 10.10.10.10).

If the application type is RDP, type the IP address of the RDP host

(for example, 10.10.10.10).

If the application type is SSH, type the IP address of the SSH host

(for example, 10.10.10.10).

See also

•

Viewing the SSL VPN bookmark list

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring SSL VPN bookmarks and bookmark groups

Configuring a FortiGate SSL VPN

•

Viewing the SSL VPN Bookmark Groups list

Configuring SSL VPN bookmark groups

Viewing the SSL VPN Bookmark Groups list

You can create a group of specific bookmarks that can be included in the

configuration of an SSL VPN user group.

To view a list of bookmark groups, go to VPN > SSL > Bookmark Group.

Figure 10: Bookmark Group list

Group Name

Bookmarks

Name of bookmark group

List of bookmarks that are components of the bookmark group in Group

Name.

Delete and Edit Delete or edit an entry in the list.

icons

See also

•

Viewing the SSL VPN bookmark list

Configuring SSL VPN bookmarks

Configuring SSL VPN bookmark groups

Go to VPN > SSL > Bookmark Group and select Create New to create a group of

selected bookmarks.

Figure 11: Create New Bookmark Group

FortiOS v3.0 MR7 SSL VPN User Guide

01-30007-0348-20080718

Download from Www.Somanuals.com. All Manuals Search And Download.

Configuring a FortiGate SSL VPN

Configuring SSL VPN bookmarks and bookmark groups

Name

Type the name of the bookmark group. The name is displayed in the

Bookmark Group list, and is a selection in the Bookmarks list in an SSL

VPN user group.

Available

Bookmarks

The list of bookmarks available for inclusion in the bookmark group.

Lists bookmarks under appropriate category (FTP, RDP, SMB, Telnet,

VNC, Web, or SSH).

Used Bookmarks The list of bookmarks that belong to the bookmark group.

Right arrow

button

Add a bookmark to the Used Bookmarks list.

Select a bookmark name in the Available Bookmarks list and select the

right arrow button to move it to the Used Bookmarks list.

Left arrow button Remove a bookmark from the Used Bookmarks list.

Select a bookmark in the Used Bookmarks list and select the left arrow

button to move it to the Available Bookmarks list.

Create New...

See also

Select to create a new bookmark for inclusion in the Available

Bookmarks list.

•