Technical Tip: SSL VPN behind NAT

[rsondal]

Description	This article discusses SSL VPN in NAT mode.
Scope	FortiGate.
Solution	There will be a private IP on the WAN interface of FortiGate from the ISP. It is possible to see the same IP on the SSL VPN setting when the WAN interface is chosen as the listening interface. Login to the ISP router with the default gateway IP on the FortiGate WAN interface, then make the port forwarding rule for the SSL VPN port and point it to the FortiGate WAN interface IP.   Then on FortiClient use the public IP and port number of SSL VPN it will work just fine. If not sure where to get public IP, see the status under the dashboard of the FortiGate, and on system information, the WAN IP will be visible as public IP see the second screenshot.                                              Or get the WAN IP from the CLI command below: diagnose sys waninfo Public/WAN IP: ... ... Or: FGT # diagnose sys waninfo ipify <ddd.ddd.ddd.ddd> or <interface name><--- Specify the source IPv4 address or interface name to know the WAN IP on a specific interface. Related article: Troubleshooting Tip: Addressing External Access Issues (VPNs, VIPs, etc.) on a FortiGate Behind ISP ...