Technical Tip: Assign fixed IP address to the users over SSL VPN tunnel with FortiAuthenticator RADIUS service

FortiGate Configuration.

Edit Web Portal configured for fixed IPs and set 'ip-mode' to 'user-group'. Once configured, all users in the authentication group must have an assigned IP otherwise authentication will fail:

config vpn ssl web portal

    edit "test_FixIP"

        set tunnel-mode enable

        set ip-mode user-group                                  <----- Default paramter: range.

        set ip-pools "Range_Fix_IP"               <----- IP range.

    next

config firewall policy
    edit 1
        set name "sslvpnPolicy"
        set srcintf "ssl.root"
        set dstintf "port1"
        set srcaddr "all"
        set dstaddr "localsubnet"
        set action accept
        set schedule "always"
        set service "ALL"
        set groups "framed_ip_grp2" "framed_ip_grp1"
    next
end

 FortiAuthenticator Radius Configuration.

1. Edit user configuration: Go under Authentication -> User Management -> Local / Remote Users -> Edit the User -> RADIUS Attributes -> Add RADIUS Attribute.

2. Add the following attribute values:

Vendor: Default.
Attribute ID: Framed-IP-Address.
Value:  <IP in the range defined on ip-pools>.

Related article:

Technical Tip: Radius authentication with FortiAuthenticator