How to prevent SSL-VPN port from using all configured IP addresses

Forum|Forum|1 year ago
December 2, 2024
2 replies
806 views

WAN1 port has got 5 different IPs from the same block. I noticed SSL-VPN is active all of those IPs, but I wish for it to only reply to the main address.

Are you forced to write a specific firewall policy, or is there a way to only bind SSL-VPN service to a single, specific IP address?

FortiGate

sjoshi

Staff

Hi,

Is the public IP directly configured on the FGT interface or is there any upstream device

Thanks, Salon

dingjerry_FTNT

Staff

Hi @raffas ,

1) Create one loopback interface with one non-used IP and bind SSL VPN to this interface instead of WAN1;

2) Create one VIP with the Public IP that you need for SSL VPN and map to this loopback IP. It's better to turn on port forwarding with the SSL VPN port number, i.e.: 10443

3) Create a firewall policy with VIP applied from WAN1 to this loopback Interface.

The rest are the regular SSL VPN configurations.

Sign up

Login with SSO

Login to the community

Login with SSO