Technical Tip: SSL VPN listening Port enablement in FortiGate with Policy Based NGFW Mode

[ekrishnan]

Description	This article describes how to allow an SSL VPN listening port in a policy-based NGFW Mode.
Scope	FortiGate, Central SNAT, Policy-Based NGFW Mode.
Solution	In Policy Based FortiGate, to allow SSL VPN listening port the SSL Inspection and Authentication, rule should be in place. Below is the example without SSL Inspection and Authentication rule : Security Policy is configured to allow VPN connection: The SSL VPN settings is using port 20443 as the listening port: When checking the Local-in-policy for port 20433 this should be shown in the list but in the example below this is not seen: Due to this, the SSL VPN login page will not show up if accessing via web mode or tunnel mode FortiClient VPN will not be established as the port is not in listening state/ Not allowed yet. Solution: Create a rule for SSL Inspection and Authentication for the SSL VPN interface and place it below the Default rule as per below: It will be now possible to see the port being allowed in Local in Policy: The SSL VPN login page listening on port 20443: