Proctect VPN gateway

Huh?  What do you mean?  Are firewall policies not enough for your use-case?  Are you doing full tunnel or split tunnel?

hello,

yes, 

Theoretically everybody in the Internet can try to access to our SSL VPN web page (and try some attacks)  - is possible to limit only to authorized device (company devices) ?? 

For Tunel mode we are not using split tunnel. 

Thanks,

Hey tedew,

it's a bit tricky to protect a VPN gateway from the internet - the whole point is that your VPN users can access the gateway from anywhere, essentially.
That being said, you can do a few things to protect the gateway:
- put a Web Application Firewall in front, as suggested by Adam
- create local-in policies on FortiGate to block certain source addresses/IP blocks (like IP ranges associated with specific geographic locations)
- in the SSLVPN settings, limit access to specific source IPs:

-> this would only be an option if you know the IPs your users will connect with, or at least a broader range your users will utilize

Hello,

Thanks for sugestions.

I heard that some organizations put some kind of proxy (server or appliance  + yubikey,  i don't know exactly) before vpn. So my understanding was that user first authenticate with proxy then in vpn. It looks like layered model of authenticate, did You hear about something like this ?? 

I will read about FortiNAC. 

Thanks, 

You could create a loopback IP address and have the VPN listening on this interface. Now you can create a FW policy from WAN->Loopback interface and apply protection on this policy.