Multiple user groups with different access permissions
You might need to provide access to several user groups with different access permissions. Consider the following example topology in which users on the Internet have controlled access to servers and workstations on private networks behind a FortiGate unit.
In this example configuration, there are two users:
- User1 can access the servers on Subnet_1.
- User2 can access the workstation PCs on Subnet_2.
You could easily add more users to either user group to provide them access to the user group’s assigned web portal.
General configuration steps
- Create firewall addresses for:
- The destination networks.
- Two non-overlapping tunnel IP address ranges that the FortiGate unit will assign to tunnel clients in the two user groups.
- Create two web portals.
- Create two user accounts, User1 and User2.
- Create two user groups. For each group, add a user as a member and select a web portal. In this example, User1 will belong to Group1, which will be assigned to Portal1 (similar configuration for User2).
- Create security policies:
- Two SSL VPN security policies, one to each destination.
- Two tunnel-mode policies to allow each group of users to reach its permitted destination network.
- Create the static route to direct packets for the users to the tunnel.
Creating the firewall addresses
Security policies do not accept direct entry of IP addresses and address ranges. You must define firewall addresses in advance.
Creating the destination addresses
SSL VPN users in this example can access either Subnet_1 or Subnet_2.
To define destination addresses - web-based manager:
- Go to Policy & Objects > Objects > Addresses.
- Select Create New, enter the following information, and select OK:
Name | Subnet_1 |
Type | Subnet |
Subnet/IP Range | 10.11.101.0/24 |
Interface | port2 |
- Select Create New, enter the following information, and select OK:
Name | Subnet_2 |
Type | Subnet |
Subnet/IP Range | 10.11.201.0/24 |
Interface | port3 |
Creating the tunnel client range addresses
To accommodate the two groups of users, split an otherwise unused subnet into two ranges. The tunnel client addresses must not conflict with each other or with other addresses.
To define tunnel client addresses - web-based manager:
- Go to Policy & Objects > Objects > Addresses.
- Select Create New, enter the following information, and select OK:
Name | Tunnel_group1 |
Type | IP Range |
Subnet/IP Range | 10.11.254.1-10.11.254.50 |
Interface | Any |
- Select Create New, enter the following information, and select OK.
Name | Tunnel_group2 |
Type | IP Range |
Subnet/IP Range | 10.11.254.51-10.11.254.100 |
Interface | Any |
Creating the web portals
To accommodate two different sets of access permissions, you need to create two web portals, portal1 and portal2, for example. Later, you will create two SSL VPN user groups, one to assign to portal1 and the other to assign to portal2.
To create the portal1 web portal:
- Go to VPN > SSL > Portals and select Create New.
- Enter
portal1
in the Name field. - In Source IP Pools, select Tunnel_ group1.
- Select OK.
To create the portal2 web portal:
- Go to VPN > SSL > Portals and select Create New.
- Enter
portal2
in the Name field and select OK. - In IP Pools, select Tunnel_ group2
- Select OK.
Later, you can configure these portals with bookmarks and enable connection tool capabilities for the convenience of your users.
Creating the user accounts and user groups
After enabling SSL VPN and creating the web portals that you need, you need to create the user accounts and then the user groups that require SSL VPN access.
Go to User & Device > User > User Definition and create user1 and user2 with password authentication. After you create the users, create the SSL VPN user groups.
To create the user groups - web-based manager:
- Go to User & Device > User > User Groups.
- Select Create New and enter the following information:
Name | Group1 |
Type | Firewall |
- From the Available list, select User1 and move it to the Members list by selecting the right arrow button.
- Select OK.
- Repeat steps 2 through 4 to create Group2, assigned to Portal2, with User2 as its only member.
Creating the security policies
You need to define security policies to permit your SSL VPN clients, web-mode or tunnel-mode, to connect to the protected networks behind the FortiGate unit. Before you create the security policies, you must define the source and destination addresses to include in the policy. See Creating the firewall addresses.
Two types of security policy are required:
- An SSL VPN policy enables clients to authenticate and permits a web-mode connection to the destination network. In this example, there are two destination networks, so there will be two SSL VPN policies. The authentication ensures that only authorized users can access the destination network.
- A tunnel-mode policy is a regular ACCEPT security policy that enables traffic to flow between the SSL VPN tunnel interface and the protected network. Tunnel-mode policies are required if you want to provide tunnel-mode connections for your clients. In this example, there are two destination networks, so there will be two tunnel-mode policies.
To create the SSL VPN security policies - web-based manager:
- Go to Policy & Objects > Policy > IPv4 and select Create New.
- Enter the following information and click OK:
Incoming Interface | ssl.root (sslvpn tunnel interface) |
Source Address | All |
Source User(s) | Group1 |
Outgoing Interface | port2 |
Destination Address | Subnet_1 |
Service | All |
- Select Create New.
- Enter the following information:
Incoming Interface | ssl.root (sslvpn tunnel interface) |
Source Address | All |
Source User(s) | Group2 |
Outgoing Interface | port3 |
Destination Address | Subnet_2 |
Service | All |
- Click OK.
Configuring authentication rules
- Go to VPN > SSL > Settings and select Create New under Authentication/Portal Mapping.
- Add an authentication rule for the first remote group:
Users/Groups | Group1 |
Portal | Portal1 |
- Select OK and Apply.
- Select Create New and add an authentication rule for the second remote group:
Users/Groups | Group2 |
Portal | Portal2 |
- Select OK and Apply.
To create the tunnel-mode security policies - web-based manager:
- Go to Policy & Objects > Policy > IPv4 and select Create New.
- Enter the following information, and select OK:
Incoming Interface | ssl.root (sslvpn tunnel interface) |
Source Address | Tunnel_group1 |
Source User(s) | Group1 |
Outgoing Interface | port2 |
Destination Address | Subnet_1 |
Service | All |
Action | ACCEPT |
Enable NAT | Enable |
- Select Create New.
- Enter the following information, and select OK:
Incoming Interface | ssl.root (sslvpn tunnel interface) |
Source Address | Tunnel_group2 |
Source User(s) | Group2 |
Outgoing Interface | port3 |
Destination Address | Subnet_2 |
Service | All |
Action | ACCEPT |
Enable NAT | Enable |
Create the static route to tunnel mode clients
Reply packets destined for tunnel mode clients must pass through the SSL VPN tunnel. You need to define a static route to allow this.
To add a route to SSL VPN tunnel mode clients - web-based manager:
- Go to Router > Static > Static Routes and select Create New.
For low-end FortiGate units, go to System > Network > Routing and select Create New. - Enter the following information and select OK.
Destination IP/Mask | 10.11.254.0/24
This IP address range covers both ranges that you assigned to SSL VPN tunnel-mode users. See Creating the tunnel client range addresses. |
Device | Select the SSL VPN virtual interface, ssl.root for example. |
In this example, the IP Pools field on the VPN > SSL > Settings page is not used because each web portal specifies its own tunnel IP address range. |