Technical Tip: Allow SSL VPN on FortiGate Policy-Based mode

[fsoares]

Description	This article describes how to allow SSL VPN when the FortiGate is operating in Policy-based mode. By default, SSL VPN connections will not be allowed.
Scope	FortiGate, FortiClient.
Solution	After configuring the following: SSL-VPN Settings: SSL-VPN Settings SSL-VPN Portal: SSL-VPN Portal Security Policy: Firewall Policy FortiClient: When trying to connect, the following message will be faced on the FortiClient: FortiClient And upon running the following debug commands... diagnose debug application sslvpn -1 diagnose debug enable The following is the output (no processing): Debug When checking the VPN process running on the firewall returns no process for SSLVPND. However, the sniffer shows incoming packets: Sniffer The debug flow output shows 'msg="iprope_in_check() check failed on policy 0, drop"': An SSL-Inspection & Authentication Policy must be created: config firewall policy edit 2 set name "Allow_SSL-VPN" set srcintf "ssl.root" set dstintf "internal" set srcaddr "SSLVPN_TUNNEL_ADDR1" set dstaddr "all" set service "ALL" set groups "VPN_Users" next end Inspection&Authentication After this change, the FortiGate will start to process incoming SSL VPN traffic. SSLVPND process also shows up: