FortiOS 5.4 Online Help Link FortiOS 5.2 Online Help Link FortiOS 5.0 Online Help Link FortiOS 4.3 Online Help Link

Home > Online Help

> Chapter 22 - SSL VPN > Basic configuration > Configuring SSL VPN web portals

Configuring SSL VPN web portals

The SSL VPN portal enables remote users to access internal network resources through a secure channel using a web browser. FortiGate administrators can configure login privileges for system users as well as the network resources that are available to the users.

FortiOS supports LDAP password renewal notification and updates through SSL VPN. Configuration is enabled using the CLI commands:

config user ldap
  edit <username>
       set server <domain>
       set password-expiry-warning enable
       set password-renewal enable
end


For more information, see the Authentication Guide.

This step in the configuration of the SSL VPN tunnel sets up the infrastructure; the addressing, encryption, and certificates needed to make the initial connection to the FortiGate unit. This step is also where you configure what the remote user sees with a successful connection. The portal view defines the resources available to the remote users and the functionality they have on the network.

SSL connection configuration

To configure the basic SSL VPN settings for encryption and login options, go to VPN > SSL > Settings.

Listen on Interface(s) Define the interface which the FortiGate will use to listen for SSL VPN tunnel requests. This is generally your external interface.
Listen on Port Enter the port number for HTTPS access.
Restrict Access Restrict accessibility to either Allow access from any host or to Limit access to specific hosts as desired. If selecting the latter, you must specify the hosts.
Server Certificate Select the signed server certificate to use for authentication. If you leave the default setting (Fortinet_CA_SSLProxy), the FortiGate unit offers its built-in certificate from Fortinet to remote clients when they connect. A warning appears that recommends you purchase a certificate for your domain and upload it for use.
Require Client Certificate Select to use group certificates for authenticating remote clients. When the remote client initiates a connection, the FortiGate unit prompts the client for its client-side certificate as part of the authentication process.

For information on using PKI to provide client certificate authentication, see the Authentication Guide.
Idle Logout Type the period of time (in seconds) that the connection can remain inactive before the user must log in again. The range is from 10 to 28800 seconds. Setting the value to 0 will disable the idle connection timeout. This setting applies to the SSL VPN session. The interface does not time out when web application sessions or tunnels are up.
Address Range Select Specify custom IP ranges to select the range or subnet firewall addresses that represent IP address ranges reserved for tunnel-mode SSL VPN clients.
DNS Server Enter up to two DNS servers (IPv4 or IPv6) to be provided for the use of clients.
Specify WINS Servers Enable to access options for entering up to two WINS servers (IPv4 or IPv6) to be provided for the use of clients.
Allow Endpoint Registration Select so that FortiClient registers with the FortiGate unit when connecting. If you configured a registration key by going to System > Config > Advanced, the remote user is prompted to enter the key. This only occurs on the first connection to the FortiGate unit.

Portal configuration

The portal configuration determines what the remote user sees when they log in to the portal. Both the system administrator and the user have the ability to customize the SSL VPN portal.

To view the portals settings page, go to VPN > SSL > Portals.

There are three pre-defined default portal configurations available:

  • full-access
  • tunnel-access
  • web-access

Each portal type includes similar configuration options. Select between the different portals by double-clicking one of the default portals in the list. You can also create a custom portal by selecting the Create New option at the top.

Name The name for the portal.
Enable Tunnel Mode If your web portal provides tunnel mode access, you need to configure the Tunnel Mode widget. These settings determine how tunnel mode clients are assigned IPv4 addresses.
Enable Split Tunneling Select so that the VPN carries only the traffic for the networks behind the FortiGate unit. The user’s other traffic follows its normal route.

If you enable split tunneling, you are required to set the Routing Address, which is the address that your corporate network is using. Traffic intended for the Routing Address will not be split from the tunnel.
Source IP Pools Select an IPv4 Pool for users to acquire an IP address when connecting to the portal. There is always a default pool available if you do not create your own.
Enable IPv6 Tunnel Mode If your web portal provides tunnel mode access, you need to configure the Tunnel Mode widget. These settings determine how tunnel mode clients are assigned IPv6 addresses.
Enable IPv6 Split Tunneling Select so that the VPN carries only the traffic for the networks behind the FortiGate unit. The user’s other traffic follows its normal route. This applies only to IPv6 tunnels.

If you enable split tunneling, you are required to set the Routing Address, which is the address that your corporate network is using. Traffic intended for the Routing Address will not be split from the tunnel.
Source IPv6 Pools Select an IPv6 Pool for users to acquire an IP address when connecting to the portal. There is always a default pool available if you do not create your own.
Client Options These options affect how the FortiClient application behaves when connected to the FortiGate VPN tunnel. When enabled, a check box for the corresponding option appears on the VPN login screen in FortiClient, and is not enabled by default.

Save Password - When enabled, if the user selects this option, their password is stored on the user’s computer and will automatically populate each time they connect to the VPN.

Auto Connect - When enabled, if the user selects this option, when the FortiClient application is launched, for example after a reboot or system startup, FortiClient will automatically attempt to connect to the VPN tunnel.


Always Up (Keep Alive) - When enabled, if the user selects this option, the FortiClient should try to reconnect once it detects the VPN connection is down unexpectedly (not manually disconnected by user).
Enable Web Mode Select to enable web mode access.
Portal Message This is a text header that appears on the top of the web portal.
Theme A color styling specifically for the web portal.
Page Layout Select one column or two column layouts for the widgets that appear on the web portal page.
Include Status Information Select to display the Status Information widget on the portal page. The Status Information widget displays the login name of the user, the amount of time the user has been logged in, and the inbound and outbound traffic statistics.
Include Connection Tool Select to display the Connection Tool widget on the portal page. Use the Connection Tool widget to connect to a internal network resource without adding a bookmark to the bookmark list. You select the type of resource and specify the URL or IP address of the host computer.
Include FortiClient Download Select to include the FortiClient Download option in the web portal. This is enabled by default.
Prompt Mobile Users to Download FortiClient Application If a remote user is using a web browser to connects to the SSL VPN in web mode, they are prompted to download the FortiClient application. The remote user can accept or reject the notification. If the user accepts, they are redirected to the FortiClient web site.
Include Login History Select to include user login history on the web portal.
Enable User Bookmarks Select to include bookmarks on the web portal. Bookmarks are used as links to internal network resources. When a bookmark is selected from a bookmark list, a pop-up window appears with the web page. Telnet, VNC, and RDP require a browser plugin. FTP and Samba replace the bookmarks page with an HTML file-browser.
Limite Users to One SSL-VPN Connection at a Time You can set the SSL VPN tunnel such that each user can only log into the tunnel one time concurrently per user per login. That is, once logged into the portal, they cannot go to another system and log in with the same credentials again. This option is disabled by default.

 

If your network configuration does not contain a default SSL VPN portal, you might receive the error message “Input value is invalid” when you attempt to access VPN > SSL > Portals.

To enable a default portal - CLI:

config vpn ssl settings
  set default-portal <full-access | tunnel-access |
    web-access>

end

Adding bookmarks

A web bookmark can include login credentials to automatically log the SSL VPN user into the website. When the administrator configures bookmarks, the website credentials must be the same as the user’s SSL VPN credentials. Users configuring their own bookmarks can specify alternative credentials for the website.

To add a bookmark - web-based manager:
  1. On the VPN > SSL > Portals page, ensure Enable User Bookmarks is enabled.
  2. Select Create New and enter the following information:
Category Select a category, or group, to include the bookmark. If this is the first bookmark added, you will be prompted to add a category. Otherwise, select Create from the drop-down list.
Name Enter a name for the bookmark.
Type Select the type of link from the drop-down list. Telnet, VNC, and RDP require a browser plugin. FTP and Samba replace the bookmarks page with an HTML file-browser.
URL Enter the IP address source.
Description Enter a brief description of the link.
Single Sign-On Enable if you wish to use Single Sign-On (SSO) for any links that require authentication.

When including a link using SSO, be sure to use the entire URL. For example, http://10.10.1.0/login, rather than just the IP address.
  1. Select OK.

For more configuration options, see Configuring SSL VPN web portals.

Personal bookmarks

The administrator has be ability to view bookmarks the remote client has added to their SSL VPN login in the bookmarks widget. This enables the administrator to monitor and, if needed, remove unwanted bookmarks that do not meet with corporate policy.

To view and maintain remote client bookmarks, go to VPN > SSL > Personal Bookmarks.

For more information about available bookmark applications, see Applications available in the web portal

SSL VPN Realms

You can go to VPN > SSL > Realms and create custom login pages for your SSL VPN users. You can use this feature to customize the SSL VPN login page for your users and also to create multiple SSL VPN logins for different user groups.

In order to create a custom login page using the web-based manager, this feature must be enabled using Feature Select.

Before you begin, copy the default login page text to a separate text file for safe-keeping. Afterward, if needed, you can restore the text to the original version.
To configure SSL VPN Realms - web-based manager:
  1. Configure a custom SSL VPN login by going to VPN > SSL > Realms and selecting Create New. Users access different portals depending on the URL they enter.
  2. The first option in the custom login page is to enter the path of the custom URL.
    This path is appended to the address of the FortiGate unit interface to which SSL VPN users connect. The actual path for the custom login page appears beside the URL path field.
  3. You can also limit the number of users that can access the custom login at any given time.
  4. You can use HTML code to customize the appearance of the login page.
  5. After adding the custom login, you must associate it with the users that will access the custom login. Do this by going to VPN > SSL > Settings and adding a rule to the Authentication/Portal Mapping section.
  6. Under Authentication/Portal Mapping, click Create New and select the user group(s) and the associated Realm.
To configure SSL VPN Realms - CLI:

config vpn ssl web realm

edit <url-path>

set login-page <content_str>

set max-concurrent-user <int>

set virtual-host <hostname_str>

end

 

Where the following variables are set:

Variable Description Default
edit <url-path> Enter the URL path to access the SSL-VPN login page.
Do not include “http://”.
No default.
login-page <content_str> Enter replacement HTML for SSL-VPN login page. No default.
max-concurrent-user <int> Enter the maximum number of concurrent users allowed. Range 0-65 535. 0 means unlimited. 0
virtual-host <hostname_str> Enter the virtual host name for this realm. Optional. Maximum length 255 characters. No default.

Tunnel mode and split tunneling

If you want your web portal to have tunnel mode access, select Tunnel Mode when creating a new portal. Enable Split Tunneling so that the VPN carries only the traffic for the networks behind the FortiGate unit. The user’s other traffic follows its normal route.

When you enable split tunneling, you are required to set the Routing Address, which is the address that your corporate network is using. Traffic intended for the Routing Address will not be split from the tunnel.

CLI Syntax:

config vpn ssl web portal

edit "full-access"

set tunnel-mode enable

set web-mode enable

set mac-addr-check enable

set ip-pools "SSLVPN_TUNNEL_ADDR1"

set split-tunneling-routing-address "Internal_subnet"

Port forwarding

Port forwarding provides a method of connecting to application servers without configuring a tunnel mode connection, and requiring the installation of a tunnel mode client. Set up the portal as described at Configuring SSL VPN web portals. To configure the application, create a bookmark with the Type field set to Port Forward.

Ensure that Port Forward is enabled in the Applications list.