Technical Tip: How to use 'ssl.root' interface in zone

[ssteo]

Description

This article describes how to use use 'ssl.root' interface in the zone.

Related document.
https://docs.fortinet.com/document/fortigate/7.0.0/new-features/538358/use-ssl-vpn-interfaces-in-zon...

https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/538358/using-ssl-vpn-interfa...

Scope

FortiGate.

Solution

Go to Network -> Interfaces -> Create New -> Zone.

Select 'ssl.root' in zone. Make sure 'ssl.root' is not using in any firewall policy. If not, it will not be possible to see 'ssl.root' appear in the list.

The next step should be to create an IPv4 policy that will allow VPN users to authenticate and connect:

Note:

Since the Zone contains more than just the ssl.root interface, and authentication is configured under the IPv4 policy, users coming from other interfaces inside the zone will be prompted for authentication. It is not possible to combine the ssl.root interface with port 7 at the Incoming Interface at the  Firewall Policy.