Technical Tip: FortiGate SSL VPN with 2FA behind another firewall

[alwis]

Description	This article describes which destination addresses and services need to be allowed on Upstream devices.
Scope	Fortigate, Fortitoken, 2FA
Solution	Suppose there is a downstream FortiGate which having limited connectivity to the internet but want to implement SSL VPN with FortiToken 2FA on the downstream Firewall. Topology: WAN ---- FW1 [Upstream] <------->  FW2 [Downstream] Open SMTP port on Upstream FireWall (In this case port 587, change according to the setup on Downstream firewall SMTP setting). Create FQDN Object to 'globalftm.fortinet.net' and allow DNS request: Firewall policy on Upstream: The 1st setup requires points 1 (to send an email to the user) and 2 (to communicate with the FortiToken server) is required.  SSL VPN connection should works after this.