Chapter 4. VPN
4.2 SSL VPN
Learning Objectives
- Configure a tunnel-based SSL VPN
- Configure a web-based SSL VPN (Web Portal)
| Device | IP address | Access |
|---|---|---|
| FortiGate | Port3: <IP_ADDRESS>/24 – DHCP (<IP_ADDRESS> to <IP_ADDRESS>)
Port2: DHCP Client |
ICMP-HTTP-HTTPS |
| WebTerm (FMC) | <IP_ADDRESS>/24 | – |
| KALI Linux (SSH Server) | <IP_ADDRESS>/24 | – |
| WordPress | <IP_ADDRESS>/24 | |
| KALI-outside | DHCP Client | |
| Windows | DHCP Client |
Configure the interfaces of the firewall. Port2 and Port3 should be configured in the terminal to access the firewall.
- Port 3 Configuration:
- Port 2 Configuration:
- Configure DHCP Server on port3.
- Configure user and user group. Go to User & Authentication > User Definition to create a local user sslvpnuser1.
Go to User & Authentication > User Groups to create a group sslvpngroup with the member sslvpnuser1.
- Configure SSL VPN web portal and Tunnel mode. Go to VPN > SSL-VPN Portals:
- Split-Tunneling: Disabled
- Source IP Pools: SSLVPN_TUNNEL_ADDR1
Go to VPN > SSL-VPN Portals, add KALI IP address (SSH Server: IP Address of Kali) and WordPress (IP Address of WordPress) in the bookmark section.
- Configure SSL VPN settings. Go to VPN > SSL-VPN Settings:
- For Listen on Interface(s), select Port2.
- Set Listen on Port to 8080.
- Server Certificate: Fortinet
- In restrict Access, select “Allow access from any host”
- Address range: Automatically assign address.
- In Authentication/Portal Mapping All Other Users/Groups, set the Portal to MyPortal
- Create new Authentication/Portal Mapping for group sslvpngroup mapping portal MyPortal.
- Configure SSL VPN firewall policy:
- Go to Policy & Objects > Firewall Policy.
- Fill in the firewall policy name. In this example, SSLVPN full tunnel access.
- The incoming interface must be SSL-VPN tunnel interface(ssl.root).
- Choose an Outgoing Interface. In this example, port3.
- Set the Source to all and group to sslvpngroup.
- Set the Destination to all.
- Set Schedule to always, Service to ALL, and Action to Accept.
- Now connect to Kali outside and open the browser https://IP-PORT 2-Firewall:8080
Enter the username and password you created earlier. Then try to connect to the KALI SSH Server and WordPress through the browser. - Now, go to Windows and install FortiClient on Windows. Try to use FortiClient to connect through SSLVPN.
- Configure FortiClient.
- Verify configuration. Enter the Username and Password you have set for SSLVPN.
Accept the Certificate Issuer to have a secure connection.
Verify your connectivity by entering the IP address of WordPress.
Verify your connectivity by entering the IP address of SSH Server.