SSL VPN portal profile based Host check

Forum|Forum|3 years ago
August 18, 2022
2 replies
3837 views

Hi,

I am working on an SSL VPN configuration to perform host check of the PC user1 is connecting. If the PC is joined to domain1, then give him portal profile A, otherwise give him portal profile B.

Basically we would like to limit access for Non-domain joined PCs.

I have configured a host check to perform registry key check for the domain name which is working fine, however if the same user tries to connect from a non-domain joined PC, it does not connect them at all. I would like them to be able to connect, but have limited access and a different IP address.

FortiGate

ChrisTan

Staff

Does a realm + portal help in your case? If with no-domain PC, try https://wanip/byod byod is your new realm that also matches LDAP user but no registry key check. The new portal can help to achieve limited access and a different IP address.

kkoshanAuthor

Visitor III

Thanks for the quick response Chris. Anything would help. Can you guide me through a Knowledge base which I can use to ahcieve this?

ChrisTan

Staff

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/724772/ssl-vpn-multi-realm

This is the realm config example.

The purpose of the realm here is to allow user login from different channels. You can apply with different portals that match different host check, for example, 'domain' portal with domain host registry check and 'BYOD' portal with MAC address check, as well as a different IP address pool.

kkoshanAuthor

Visitor III

Thanks Chris, we want the URL to not change. Both machines should be able to connect to VPN and use the same URL.

So, I want the host check to check if the registery key is present, if yes then give the user Profile Domain, if not then give the user Profile BYOD

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded