Skip to main content
robdog
robdog
New Member
June 12, 2017
Question

Multi User SSL VPN 5.4.4

  • June 12, 2017
  • 1 reply
  • 5360 views

Hi Guys,

 

I'm just wondering if you can shed any light on a configuration query I have. 

 

I have a requirement to setup a SSL VPN for 2 separate user groups, who require different levels of access to network resources.

I found this guide detailing how to do it.

http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigatesslvpn54/SSLVPN_Examples_54/Multi_Groups_Different_AccessPerms.htm

 

However my question is, is it possible to achieve the above while still using split tunneling and if so can you point me in the right direction?

1 reply

emnoc
emnoc
New Member
June 12, 2017

Yes you can host multiple groups with and without split-tunneling

 

e.g ( various groups and  with split tunnel or  splitunnel client routes )

 

config vpn ssl web portal     edit "GRUPO1"

          set tunnel-mode enable           set keep-alive enable            set ip-pools "SSLVPNGROUP01"

           set split-tunneling-routing-address  NET01INTERNALS

           set ip-mode user-group

   next

      edit "GRUPO2"

          set tunnel-mode enable           set keep-alive enable            set ip-pools "SSLVPNGROUP02"

           set split-tunneling-routing-address  NET02INTERNALS

           set ip-mode user-group

   next

     edit "DEVOPS"

          set tunnel-mode enable           set keep-alive enable            set ip-pools "SSLVPNGROUP03"

           set split-tunneling enable

           set ip-mode user-group

   next

end

 

robdog
robdogAuthor
New Member
June 12, 2017

Thanks for the helpful reply emnoc. 

 

I have a radius server auth for group 1 and two factor ldap+fortitoken auth for group 2

 

Do i need to apply multiple policy's below or not?

 

config firewall policy edit 2 set name "Group 1" set uuid da31036e-9ac3-51e6-5f71-562a4cb5acdc set srcintf "ssl.root" set dstintf "Internal" set srcaddr "ssl.vpn.clt.ip_a" set dstaddr "internal.subnets_a" set action accept set schedule "always" set service "HTTP" "HTTPS" set logtraffic disable set groups "group_a" set comments "group_a" next edit 3 set name "Group 2" set uuid 5465621c-3c75-51e7-eea9-9426373df718 set srcintf "ssl.root" set dstintf "Internal" set srcaddr "ssl.vpn.clt.ip_b" set dstaddr "internal.subnets_b" set action accept set schedule "always" set service "HTTP" "HTTPS" set logtraffic disable set groups "group_b" set comments "group_b" next

emnoc
emnoc
New Member
June 12, 2017

Yes you could do just that. Apply to policies and even authentication methods could be different between the groups.

 

 

[ul]
  •    local
  •    radius
  •    ldap
  •    radius+mfa[/ul][ul]
  •    etc......[/ul]

     

    Other choices would config auth-rule and realms, and here you set  auth methods unique for that realm

     

    e.g realm

     

    /roadwarriors1   ( LDAP )

    /roadwarriors2   ( RADIUS )

    /roadwarriors3  ( local )

     

    ! under each group you set the members or auth-server

    ! here's an method for user ad server for roadwarrier

     

    config match     edit 1         set server-name "ROADWARRIERAD1"    <----this would be AD server forRoadWarrier group         set group-name "OU=user,DC=example,DC=com"     next end

     

    Each realm would have a unique fwpolicy and address groups

    Take a look at this post of my  explain exactly the above, your  possibilities and limitations are wide and deep ;)

     

    http://socpuppet.blogspot.com/2017/05/fortigate-sslvpn-and-multiple-realms.html

     

    Disregard the language parameters but the above concept could group like-as uses and with a personal realm for that users groups.

     

    The auth-rule controls exactly just that authentication  methods. Than enable or disable  split-tunnel per realm as required via the tunnel-portal.

     

     

     

    Ken

     

     

    • Terms & ConditionsAccessibility statement