Technical Tip: Adding groups to SSLVPN policies with VIPs
Description
This article describes how groups can be added to SSLVPN policies with Virtual IPs (VIP: DNAT objects) as destination.
Solution
Under some circumstances, when attempting to add groups to a policy from SSLVPN to a VIP as destination, the FortiGate can through up errors when attempting to add a usergroup:
GUI error: 'Failed to save some changes: Entry not found.'
or from CLI:
# config user policyThis is triggered if the user group to be added is associated with a SSLVPN portal in web-mode.
edit <ID>
set group testgroup
end
entry not found in datasource
value parse error before 'testgroup'
Command fail. Return code -3
VIPs are not intended for web-mode SSLVPN access, so FortiGate does not allow for adding these groups.
The VPN portal where the FortiGate is associated needs to be switched to tunnel-mode.
The VPN portal where the FortiGate is associated needs to be switched to tunnel-mode.
Once this is done, the group can be added to the policy with destination VIP.