Skip to main content
REDES_UCHILE
Visitor III
October 7, 2024
Question

Default VPN-SSL realm in multirealms scenario

  • October 7, 2024
  • 9 replies
  • 2485 views

 

Hello everyone:

 

We are new Fortinet costumer and need help with the default domain configuration in a multirealm SSL VPN scenario.

 

For example, we have the following realms configured:

- https://vpn.domain.com (default realm)
- https://vpn.domain.com/realm1 (realm 1)
- https://vpn.domain.com/realm2 (realm 2)

 

Our idea is that users can connect only to these 3 realms.

 

But when testing, we noticed that if a user mistypes one of the realms (by example: https://vpn.domain.com/realm200), the user is redirected to the default realm.

 

This is not desired. We expect that if this happens, the connection will be discarded by the firewall because there is no realm to match.

 

Is that possible?.

 

Thanks in advance

 

9 replies

ebilcari
Staff
Staff
October 8, 2024

What's the FGT firmware version in this setup? I tested in 7.2.10 and the realms that don't exist will not open:

reaml-sslvpn.PNG

There are some changes on the latest firmware and the behavior may have changed in 1066448.

Emirjon
REDES_UCHILE
Visitor III
October 8, 2024

We have an FGT-3300E with 7.0.14

rbraha
Staff
Staff
October 8, 2024

Hi @REDES_UCHILE 

I would say its expected to be redirected to default realm because FGT cannot redirect the user to the correct realm ,which if using web mode you can probably save it as bookmark in end user browser or if using free version of FortiClient you can save on Remote Gateway ,URL of firewall including realm so user can only enter credentials to authenticate.

REDES_UCHILE
Visitor III
October 8, 2024

First of all, thank you for replying.

 

We have VPN web access disabled, so we are using the Forticlient VPN only.

 

While saving the Remote Gateway URL is an option, it is not ideal for us.

 

We would like the FGT to notice that the realm does not exist and therefore discard the connection attempt.

 

Regards

Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.