Can forticlient do this?

Question

Hello,

In our environment we have a Fortigate 100 D, I'm planning to deploy in all laptop a VPN client, ideally at the end, would be great to get this done:

- Detect if user is in our facilities or not, there's no need to connect vpn if users are in the office. So if any user goes away, vpn tunnel should connect automatically.

- Should use AD credentials, as you all know, the more passwords we have, the more support requests IT department will suffer, all laptops are protected by Active Directory credentials, so somehow security in VPN connection should be automated.

The goal is to offer VPN benefits but without any user interaction...all traffic should be routed to VPN, even Internet connections

Anyone have any experience on this?

Thank you.

Carl_Wallmark · Accepted Answer

The FortiClient relies on "ON-net/OFF-net" detection to do the tunnel.

On-net/off-net can be based on:

1.

The network you are on, let´s say 192.168.1.0/24 is considered ON-net = no tunnel

You can also specify the MAC address of your default gateway if you are on the above network.

2.

The FortiGate can add an option in the DHCP request which the FortiClient will detect, no option = you are off-net and tunnel will go up

3.

You can also use that option in a third-party DHCP, like Windows Server, add the option and specify the S/N of a firewall.

You can also make the FortiClient ping different gateways and it will choose the one with lowest latency.

EDIT:

For password, you can save the password in FortiClient, however, the user needs to save the password the first time, there is no "single-sign-on". Well, there is an option to start the tunnel when you log in to the computer, then there is a "single-sign-on"

For routing, you only need to push out 0.0.0.0/0.0.0.0 as network, and all traffic will go through the tunnel, only make sure you have firewall policies on the firewall, like SSLVPN -> WAN1, Nat enabled and all your security profiles.

MikePruett · Answer

Yes you can do that. Fortinet has a pretty good video about this. https://video.fortinet.co...n-with-forticlient-5-2

Sign up

Login with SSO

Login to the community

Login with SSO