Solved
Which tunnel pool takes presidense?
Lets say I have the following portal config:
config vpn ssl web portal
edit "VPN_Contractors_General"
set tunnel-mode enable
set forticlient-download disable
set auto-connect enable
set keep-alive enable
set save-password enable
set ip-pools "VPN_Contractors_General"
config split-dns
edit 1
set domains "louis.net,louis.com,louisgod.com"
set dns-server1 10.100.74.21
set dns-server2 10.100.90.21
next
end
next
end
Here I have defined the IP-Pool I want these users to use as VPN_Contractors_General. Now in my VPN SSL Settings I have the following:
config vpn ssl settings
set banned-cipher SHA1 SHA256 SHA384
set https-redirect enable
set servercert "star_louis_com_20250306"
set idle-timeout 900
set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"
set tunnel-ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"
set dns-server1 10.100.74.21
set dns-server2 10.100.90.21
set source-interface "port1"
set source-address "all"
set source-address6 "all"
set default-portal "full-access"
config authentication-rule
edit 2
set groups "TDS_FirewallSSO_Duo_VPN_Group"
set portal "VPN_Contractors_General"
next
end
end
In the SSL VPN Settings config is defined set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1". Which is not the same as the ip pool defined in the VPN Portal.
The question is what IP Pool will be given to the users to make it through these 2 config? I am kinda hopping the tunnel-ip-pool in the SSL VPN Settings is used if there is no ip pool configured in the portal.