Skip to main content
robert_hua
robert_hua
New Member
July 17, 2018
Solved

How to do SSLVPN login redundant ?

  • July 17, 2018
  • 2 replies
  • 5207 views

I have two WAN interface - wan1 and wan2.

SSLVPN is Listen on Interface wan1.

How do I setup the redundancy of sslvpn ? Only add WAN2 on Listen interface ?

Sorry I cannot do the experiment, cuz my Fortigate 200D is on production. 

 

Thank you.

Best answer by Toshi_Esumi

Don't forget the client side needs two separate profiles and the user manually need to choose one over the other.

To me it's pretty safe to test (adding wan2 and test SSL VPN into wan2) on the live unit without affecting to any other services including existing SSL VPNs via wan1. But if you're super careful (I wish I were), you might want to set a maintenance window and do the testing.

2 replies

rwpatterson
rwpatterson
New Member
July 17, 2018

Welcome to the forums.

 

For SSL VPN, I believe you simply create the appropriate policies and static router entries and you're good to go. Unlike IPSec VPN, SSL VPN isn't tied down by IP address on the way in, so policy alone should be good enough.

robert_hua
robert_huaAuthor
New Member
July 18, 2018

Sorry I am not good at Fortigate...

Could you describe more detail about how to create the policies and static route for "sslvpn redundancy" ?

In policy :I have SSL-VPN tunnel interface(ssl.root)-LAN

In static route : I have destination route only

 

Very appreciate !

Toshi_Esumi
SuperUser
Toshi_EsumiAnswer
SuperUser
July 17, 2018

Don't forget the client side needs two separate profiles and the user manually need to choose one over the other.

To me it's pretty safe to test (adding wan2 and test SSL VPN into wan2) on the live unit without affecting to any other services including existing SSL VPNs via wan1. But if you're super careful (I wish I were), you might want to set a maintenance window and do the testing.

Terms & ConditionsAccessibility statement