Description
This article describes how to secure the FortiGate public IP and port linked with SSL VPN.
Scope
FortiGate.
Solution
FortiGate will listen to the SSL VPN connection requests over the public IP of the interface mapped in the SSL VPN settings. As the public IP and port cannot be blocked for unknown users below are a few possible options to restrict unknown users.
1) Implement Two-factor authentication for all accounts:
Two-factor authentication prevents an attacker from being able to log in to an account only with a username and password. With the third factor, the attacker needs access to additional information like the smartphone (in case of push token) or a 6-digit number (in case of mobile or hardware Tokens).
2) Ensure that admin users have no access to the SSL VPN portal
It is recommended to differentiate between user accounts that are allowed to access VPN solutions and administrative accounts that are only allowed to access the administrative interfaces.
3) Change the listening Port for the SSL-VPN portal
Using another port is an easy but effective measurement if an attacker is only probing the default port of an application. Do not forget to change the port on all VPN clients too. Otherwise, the connection will break.
4) Limit the count of failed login attempts until the user is banned:
Fortinet has a KB article regarding the implementation of a login limit for SSL VPN under:
https://community.fortinet.com/kb/documentLink.do?externalID=FD48714
5) Restrict the source IP address area:
If users only need access to the SSL VPN portal from a specific source address or range, it is possible to limit the allowed source addresses to those addresses:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-block-by-country-or-geolocation/ta-...
6) Also consider implementing local-in policies to prevent the traffic from reaching the FortiOS in any way:
https://docs.fortinet.com/document/fortigate/6.2.9/cookbook/363127/local-in-policies
7) Ensure, that a no-access profile is enabled for 'All other users/groups':
At the bottom of the table in the 'SSL-VPN Settings' where the Authentication/Portal Mapping is configured, there is an option for 'All Other Users/Groups'. It is recommended to disallow access to the SSL VPN for groups that were not explicitly allowed on the mappings above:
# config vpn ssl web portal
edit "no-access"
set tunnel-mode disable
set ipv6-tunnel-mode disable
set web-mode disable
set allow-user-access ping
set limit-user-logins enable
set forticlient-download disable
next
end
# config vpn ssl settings
set default-portal "no-access"
end
In addition to disallowing access for 'All Other Users/Groups', it is also possible to restrict access for users and groups inside the firewall policies.
Configure those policies as selective and restrictive as possible.
