Technical Tip: Configuring SSL VPN client certific...

FortiGate

FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.

Article Id 255402

Description

This article describes how to enable SSL VPN client certificate authentication only to specific user/group.

Scope

FortiGate.

Solution

1) Disable 'require client certificate' globally:

2) Enable client-cert under the authentication rule of SSL VPN settings (this option is available via CLI only):

config vpn ssl settings

config authentication-rule

edit <no> <----- User group that should connect with LDAP client certificate authentication.

set client-cert en <----- Default is disable.

end

Note: If the users are using certificate authentication in web mode and 'require client certificate' is disabled globally, then it does not work. To work in web mode, 'require client certificate' should be enabled.

3793

Contributors

Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.

Technical Tip: Configuring SSL VPN client certificate authentication to a user/group only