SSL VPN avoid IP access

Forum|Forum|2 years ago
January 22, 2024
3 replies
1268 views

Hi all,

Is there a way to restrict SSL-VPN access solely to the FQDN, disallowing users from accessing the web portal via the IP address? We prefer users to only use the FQDN for access.

OR

Can we use multiple server certificates that cover both IP and FQDN, eliminating certificate warnings?

Any lead?

Best answer by Hong_FTNT

Hi @Fort-zender,

There is no way to allow FQDN and deny IP address as FortiGate always see traffic coming from IP addresses. FQDN is resolved at the client side.

To avoid certificate warning, you can add FortiGates IP address to the SAN field of the certificate: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Adding-SAN-Subject-Alternative-Name-while/ta-p/213434

Regards,

AEK

SuperUser

Hello

I don't think FGT can deny VPN by IP and allow with FQDN.

On the other hand you can have one single private or public certificate for both IP and FQDN.

AEK

mle2802

Staff

Hi @Fort-zender,

You can use SAN certificate for both FQDN and IP.

Hong_FTNTAnswer

Staff & Editor

Hi @Fort-zender,

There is no way to allow FQDN and deny IP address as FortiGate always see traffic coming from IP addresses. FQDN is resolved at the client side.

To avoid certificate warning, you can add FortiGates IP address to the SAN field of the certificate: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Adding-SAN-Subject-Alternative-Name-while/ta-p/213434

Regards,

Sign up

Login with SSO

Login to the community

Login with SSO