Skip to main content
rsondal
Staff
rsondal
Staff
September 5, 2023

Technical Tip: SSL VPN behind NAT

  • September 5, 2023
  • 0 replies
  • 10704 views
Description This article discusses SSL VPN in NAT mode.
Scope FortiGate.
Solution
  1. There will be a private IP on the WAN interface of FortiGate from the ISP.

 

image1.JPG

 

  1. It is possible to see the same IP on the SSL VPN setting when the WAN interface is chosen as the listening interface.

 

image2.JPG

 

  1. Login to the ISP router with the default gateway IP on the FortiGate WAN interface, then make the port forwarding rule for the SSL VPN port and point it to the FortiGate WAN interface IP.

 image3.JPG

 

  1. Then on FortiClient use the public IP and port number of SSL VPN it will work just fine. If not sure where to get public IP, see the status under the dashboard of the FortiGate, and on system information, the WAN IP will be visible as public IP see the second screenshot.
                                                

image4.JPG

 

image5.JPG

 

Or get the WAN IP from the CLI command below:

 

diagnose sys waninfo

Public/WAN IP: ...

...

 

Or:

 

FGT # diagnose sys waninfo ipify <ddd.ddd.ddd.ddd> or <interface name><--- Specify the source IPv4 address or interface name to know the WAN IP on a specific interface.

 

Related article:
Troubleshooting Tip: Addressing External Access Issues (VPNs, VIPs, etc.) on a FortiGate Behind ISP NAT Router/Modem

 

      Terms & ConditionsAccessibility statement