Client SSLVPN Pool

6 replies
2461 views

Hello gentlemen,

I need your help. I configured a SSLVPN as described in this article:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-specific-SSL-VPN-address-pool-to/ta-p/195190

It's setup with individual SSL-VPN portals, where each has it's own Source IP Pools.
SSL-VPN Settings are configured, so each User/Groups has it's own Portal.

SSLVPN client can connect, but they are not getting an IP address from the correct IP Pool.
I have check similar setups on other firewalls, and I am unable to spot the issue.

Any idea what I am missing?

FortiClient

Debbie_FTNTAnswer

Staff & Editor

Hey 45-JTP,

thanks for the screenshots!

Just to be sure - did you actually set the ranges in each individual portal?

Also - if your users match into a different group (like VPN_Alarm, instead of Vpn_HOOP), then a different portal would be applied than what you might intend, especially if your users are members of multiple groups that have VPN portals assigned.

You can find what group a user authenticated with (and thus which portal was assigned) in Event Logs > VPN; search for the user and find the tunnel setup success log, that should give you a group as well.

Cheers,

Debbie

45-JTPAuthor

New Member

Hi Linoytu
Thank you for the reply.
I have these 3 pools, but clients only get an IP from the first one name: "Clients_VPNs".
For the new setup, I want clients to get an IP from "HOOP_VPN_Pool".