New Member

Question

FORTIGATE REMOTE ACCESS AND MONITORING

Forum|Forum|4 years ago
March 16, 2022
10 replies
8686 views

Hello everyone I need help. Let me explain you. On past customers have IP public and from my office I monitor and have remote access on fortigate. now he changed he have always internet but without ip public how can I continue de have remote access to fortigate and monitor it. Waiting for you plse :pensive_face::pensive_face:.

PS: port forwarding is option from ISPdont give me this possibility.

FortiGate

sharmaj

Staff

Hi,

Actually, you need either public IP or DDNS domain to reach the FortiGate from outside as the user will not be aware of how to reach the FortiGate if the public IP is not known.

STOLLERXDAuthor

New Member

thanks your reply.

Yeah without ip public it is not simple. I though with protocol like l2tp or sstp i will be able to make (client to site vpn i've sstp server on my office). Thanks again for your time.

ede_pfau

SuperUser

My suggestion is to set up a dial-up IPsec VPN. Let the site without (permanent) public IP dial out to the FGT. Using a VPN is the only safe way to access a FGT for management.

STOLLERXDAuthor

New Member

Ok ede. but in this case what ip i must use like remote gateway on forticlient. below overview of my design i use one ip of lan isp like gateway on my fortigate

ede_pfau

SuperUser

No way, sorry. I imagined that you have a Fortigate externally. Just a FC will not do.

If you have access to the ISP router, you could port forward something onto the FGT WAN port. But if you don't I don't see any way to achieve this.

Toshi_Esumi

SuperUser

By the same token, we always use SSL VPN for remote FGT access.

Toshi

STOLLERXDAuthor

New Member

hello toshi. i dont know if i'm wrong. but to use SSL vpn you must have spécifiy public ip as remote gateway on forticlient

Debbie_FTNT

Staff & Editor

Hey Stoller,

for IPSec or SSLVPN to FortiGate, you will need a public IP or hostname to connect to, if FortiGate should be receiving the connection attempt.

In your case, you would need to set up something on your ISP router (where the actual internet breakout is) to forward connections to a specific port/IP/hostname through to FortiGate, but you mentioned this is not an option, correct?

If you have a different VPN server (with a public IP), FortiGate could initiate a connection to it (as a spoke, essentially), and you could reach FortiGate through that other VPN server.

But:
- either, you must make FortiGate reachable from internet somehow (DDNS, port forwarding)

- or FortiGate must establish a connection to a different VPN gateway to which you can also connect, and reach FortiGate through that

Sign up

Login with SSO

Login to the community

Login with SSO