FortiOS 5.4 Online Help Link FortiOS 5.2 Online Help Link FortiOS 5.0 Online Help Link FortiOS 4.3 Online Help Link

Home > Online Help

> Chapter 22 - SSL VPN > Setup examples > Multiple user groups with different access permissions

Multiple user groups with different access permissions

You might need to provide access to several user groups with different access permissions. Consider the following example topology in which users on the Internet have controlled access to servers and workstations on private networks behind a FortiGate unit.

In this example configuration, there are two users:

  • User1 can access the servers on Subnet_1.
  • User2 can access the workstation PCs on Subnet_2.

You could easily add more users to either user group to provide them access to the user group’s assigned web portal.

General configuration steps

  1. Create firewall addresses for:
  • The destination networks.
  • Two non-overlapping tunnel IP address ranges that the FortiGate unit will assign to tunnel clients in the two user groups.
  1. Create two web portals.
  2. Create two user accounts, User1 and User2.
  3. Create two user groups. For each group, add a user as a member and select a web portal. In this example, User1 will belong to Group1, which will be assigned to Portal1 (similar configuration for User2).
  4. Create security policies:
  • Two SSL VPN security policies, one to each destination.
  • Two tunnel-mode policies to allow each group of users to reach its permitted destination network.
  1. Create the static route to direct packets for the users to the tunnel.

Creating the firewall addresses

Security policies do not accept direct entry of IP addresses and address ranges. You must define firewall addresses in advance.

Creating the destination addresses

SSL VPN users in this example can access either Subnet_1 or Subnet_2.

To define destination addresses - web-based manager:
  1. Go to Policy & Objects > Objects > Addresses.
  2. Select Create New, enter the following information, and select OK:
Name Subnet_1
Type Subnet
Subnet/IP Range 10.11.101.0/24
Interface port2
  1. Select Create New, enter the following information, and select OK:
Name Subnet_2
Type Subnet
Subnet/IP Range 10.11.201.0/24
Interface port3

Creating the tunnel client range addresses

To accommodate the two groups of users, split an otherwise unused subnet into two ranges. The tunnel client addresses must not conflict with each other or with other addresses.

To define tunnel client addresses - web-based manager:
  1. Go to Policy & Objects > Objects > Addresses.
  2. Select Create New, enter the following information, and select OK:
Name Tunnel_group1
Type IP Range
Subnet/IP Range 10.11.254.1-10.11.254.50
Interface Any
  1. Select Create New, enter the following information, and select OK.
Name Tunnel_group2
Type IP Range
Subnet/IP Range 10.11.254.51-10.11.254.100
Interface Any

Creating the web portals

To accommodate two different sets of access permissions, you need to create two web portals, portal1 and portal2, for example. Later, you will create two SSL VPN user groups, one to assign to portal1 and the other to assign to portal2.

To create the portal1 web portal:
  1. Go to VPN > SSL > Portals and select Create New.
  2. Enter portal1 in the Name field.
  3. In Source IP Pools, select Tunnel_ group1.
  4. Select OK.
To create the portal2 web portal:
  1. Go to VPN > SSL > Portals and select Create New.
  2. Enter portal2 in the Name field and select OK.
  3. In IP Pools, select Tunnel_ group2
  4. Select OK.

Later, you can configure these portals with bookmarks and enable connection tool capabilities for the convenience of your users.

Creating the user accounts and user groups

After enabling SSL VPN and creating the web portals that you need, you need to create the user accounts and then the user groups that require SSL VPN access.

Go to User & Device > User > User Definition and create user1 and user2 with password authentication. After you create the users, create the SSL VPN user groups.

To create the user groups - web-based manager:
  1. Go to User & Device > User > User Groups.
  2. Select Create New and enter the following information:
Name Group1
Type Firewall
  1. From the Available list, select User1 and move it to the Members list by selecting the right arrow button.
  2. Select OK.
  3. Repeat steps 2 through 4 to create Group2, assigned to Portal2, with User2 as its only member.

Creating the security policies

You need to define security policies to permit your SSL VPN clients, web-mode or tunnel-mode, to connect to the protected networks behind the FortiGate unit. Before you create the security policies, you must define the source and destination addresses to include in the policy. See Creating the firewall addresses.

Two types of security policy are required:

  • An SSL VPN policy enables clients to authenticate and permits a web-mode connection to the destination network. In this example, there are two destination networks, so there will be two SSL VPN policies. The authentication ensures that only authorized users can access the destination network.
  • A tunnel-mode policy is a regular ACCEPT security policy that enables traffic to flow between the SSL VPN tunnel interface and the protected network. Tunnel-mode policies are required if you want to provide tunnel-mode connections for your clients. In this example, there are two destination networks, so there will be two tunnel-mode policies.
To create the SSL VPN security policies - web-based manager:
  1. Go to Policy & Objects > Policy > IPv4 and select Create New.
  2. Enter the following information and click OK:
Incoming Interface ssl.root (sslvpn tunnel interface)
Source Address All
Source User(s) Group1
Outgoing Interface port2
Destination Address Subnet_1
Service All
  1. Select Create New.
  2. Enter the following information:
Incoming Interface ssl.root (sslvpn tunnel interface)
Source Address All
Source User(s) Group2
Outgoing Interface port3
Destination Address Subnet_2
Service All
  1. Click OK.

Configuring authentication rules

  1. Go to VPN > SSL > Settings and select Create New under Authentication/Portal Mapping.
  2. Add an authentication rule for the first remote group:
Users/Groups Group1
Portal Portal1
  1. Select OK and Apply.
  2. Select Create New and add an authentication rule for the second remote group:
Users/Groups Group2
Portal Portal2
  1. Select OK and Apply.
To create the tunnel-mode security policies - web-based manager:
  1. Go to Policy & Objects > Policy > IPv4 and select Create New.
  2. Enter the following information, and select OK:
Incoming Interface ssl.root (sslvpn tunnel interface)
Source Address Tunnel_group1
Source User(s) Group1
Outgoing Interface port2
Destination Address Subnet_1
Service All
Action ACCEPT
Enable NAT Enable
  1. Select Create New.
  2. Enter the following information, and select OK:
Incoming Interface ssl.root (sslvpn tunnel interface)
Source Address Tunnel_group2
Source User(s) Group2
Outgoing Interface port3
Destination Address Subnet_2
Service All
Action ACCEPT
Enable NAT Enable

Create the static route to tunnel mode clients

Reply packets destined for tunnel mode clients must pass through the SSL VPN tunnel. You need to define a static route to allow this.

To add a route to SSL VPN tunnel mode clients - web-based manager:
  1. Go to Router > Static > Static Routes and select Create New.

    For low-end FortiGate units, go to System > Network > Routing and select Create New.
  2. Enter the following information and select OK.
Destination IP/Mask 10.11.254.0/24

This IP address range covers both ranges that you assigned to SSL VPN tunnel-mode users. See Creating the tunnel client range addresses.
Device Select the SSL VPN virtual interface, ssl.root for example.

 

In this example, the IP Pools field on the VPN > SSL > Settings page is not used because each web portal specifies its own tunnel IP address range.