SSL-VPN configuration for several external companies
Hello
i'm on configuration of our new fortigate latest OS to allow our external companies to using the ssl-vpn client to get access to our internal systems.
We have several external companies and they need to have access to different internal systems.
Neither company is allowed to see the other's systems. All of them using one VPN-Pool IP-Range (exampl. 10.10.1.0/24)
User Login is based on LDAP Auth.
I have try this configuration:
1. Setup LDAP User/Groups
2. Setup ssl-vpn-portal with split tunneling "Enabled Based on Policy Destination", Source IP Pools = 10.10.1.0/24; No "Web Mode" Active.
3. SSL-VPN Settings "Listen Interface = WAN"; Tunnel Mode Client Settings "10.10.1.0/24"; Authentication/Portal Mapping "I add all VPN Groups from our external Companies"
4. Firewall Policy, I add for all external Companies one Rule with:
Incoming Interface = ssl-vpn tunnel interface
Outgoing Interface = Internal Port to our Systems
Source = The VPN-Pool 10.10.1.0/24 and the specific ldap-group
Destination = one of the internal System for the respective company.
That all! So i have one SSL-VPN-Setting and one SSL-VPN-Protal with one VPN-Pool for all external Companies but several Firewall Policy one for each Companie.
My Question is, is this configuration OK or do i need to do anything different?
For better understanding, nomaly u configure vpn under sophos UTM so we change at the moment our FW from Sophos to Fortigate.
Many thank's in advanced
TBC