SuperUser

Question

FortiPAM Web launcher from WAN

Forum|Forum|1 year ago
September 26, 2024
11 replies
5320 views

Hello PAM admins

FortiPAM 1.4.1.

I'm very new in FortiPAM and I have questions regarding Web launcher.

When I'm in company's local network all works fine, Web launcher, RDP launcher and SSH launcher.

However when I'm outside and connect from public IP and try run Web launcher it doesn't work, while SSH launcher and RDP launcher still work fine.

I noticed that for both RDP and SSH launcher, PAM opens the browser tab with address bar contains a public address like https://pam.mycompany.com/someaddress.

While for Web launcher it opens the private IP of the target, which naturally can't work from WAN without some proxy on the client.

If I'm not wrong I think it needs FortiClient in order to work, right?

So my question:

Does it work with FortiClient for Windows, Linux & MacOS?
Does it require EMS?
Is there a plan to make it work in future release without FortiClient? (other PAM products can do it without agent)

FortiPAM

Anthony_E

Staff

Hello Abdelkrim,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

Best Regards

Anthony_E

Staff

Hello Abdelkrim,

We are still looking for someone to help you.

We will come back to you ASAP.

Regards,

Best Regards

AEKAuthor

SuperUser

Thanks Antony for your support

Nothing urgent for now.

AEK

Anthony_E

Staff

Thank you Abdelkrim :)!

Best Regards

chrisbenny

New Member

Hi,

In the target of the secret under advanced settings, have you enabled "Web proxy" and "Domain list" with access mode as "proxy" and then set up a FQDN or IP list?

https://docs.fortinet.com/document/fortipam/1.4.0/examples/699270/configuring-the-web-proxy-feature-to-prevent-web-credentials-from-leaking

https://docs.fortinet.com/document/fortipam/1.4.1/administration-guide/460943/web-proxy

AEKAuthor

SuperUser

Hi Chris

Thanks for your response.

I'll try this method and comeback with the result.

AEK

DylanFox

New Member

Any update?

KIMAN_NGOR

New Member

Hello Abdelkrim,

Here are some steps to troubleshooting:

1. Ensure that FortiPAM can access to the internal web portal, if case FQDN ,FortiPAM can resolve .

2. Make sure you have enabled web proxy on the interface. https://docs.fortinet.com/document/fortipam/1.4.0/examples/390911/enabling-the-web-proxy-feature

3. Create secret target & enable Web Proxy . https://docs.fortinet.com/document/fortipam/1.4.0/examples/2487/creating-a-secret-target-with-web-proxy

4. Add a secret target to your secret.

5. if FortiPAM is behind the FortiGate or other firewall vendor . https://docs.fortinet.com/document/fortipam/1.4.0/examples/168674/fortipam-behind-a-fortigate-device

6. Create DNAT on the firewall and allow all ports , do not specify only FortiPAM's port (FortiPAM's portal) .

Thanks,

pjaco

Explorer

Hi,

we have same problem in our environment. One question to your troubleshooting guide. Number 6 - why? Why do I have to forward all ports from external IP to FortiPAM? Customer doesn't have much free external IP addresses, we are sharing one address with multiple services. One of them is FortiPAM portal. Is it really necessary? Or could you specify which ports are needed? (except 443). Thank you.

AEKAuthor

SuperUser

This post is old but for those who may be interested here is what we found,

To properly use Web launcher from WAN (or even from LAN) you need to install FortiClient PAM, otherwise your client will try reach directly the private address of the backend Web server (bypassing PAM).

Initially this was not obvious for me at all since other known PAM solutions don’t need any proxy component to be installed on the client.

Now in case you access the PAM through VPN (IPsec or SSL) then know that you need FortiClient commercial version, since FortiClient VPN cannot cohabit with FortiClient PAM.

AEK

Sign up

Login with SSO

Login to the community

Login with SSO