Technical Tip: Software Installation and Process as SSL VPN host check requirements

[anderson_yee]

Description

This article describes how to use SSL VPN host check features to allow or prevent endpoints from connecting to FortiGate through SSL VPN, depending on software installation and process running state.

Scope

FortiGate, SSL VPN.

Solution

In certain organizations, endpoints are needed to install and run specified software before they can establish an SSL VPN connection.

For example, consider the following scenario: before making SSL VPN connections, endpoints are required to install endpoint security software (such as TrendMicro).
This article will demonstrate the process of setting up a custom host check policy and utilizing it to target a particular SSL VPN user group through the SSL VPN portal.

SSL VPN host check policy configuration.

1. Using the registry editor, locate 'InstallStatus' under the TrendMicro software directory; this will be used as a custom registry check parameter.

2. Run the software and identify the process name (for example, TmsaInstance64.exe) by running tasklist under the command prompt.
                                                                                         

3. Using the acquired information, set up an SSL VPN host check policy that includes both registry and process checks.
   SSL VPN host check policy name: trendmicro_check.
   Registry check: HKEY_LOCAL_MACHINE\\SOFTWARE\\TrendMicro:InstallStatus==1.
   Process check: TmsaInstance64.exe.

Notes:

• Both 'HKLM' and 'HKEY_LOCAL_MACHINE' work under registry check.
• SSLVPN host check features are only available in the free FortiClient as of version 7.0.3 and above.
• The item checklist functions as an AND operator: for the SSL VPN to establish a connection, it needs to meet both requirements. (For example, the TrendMicro software is installed and running.)
• On the other hand, if one of the host check requirements is not matched (for example, TrendMicro software is installed but not running), SSL VPN users will be unable to connect.
  
  

4. Apply the SSL VPN host check policy to the specific SSL VPN portal (for example, full-access):

For more information on host-check-policy passing conditions, check the following article: Technical Tip: Details about host check list and host-check passing conditions.

Testing and validation.
Case 1: TrendMicro software is not installed, or it is installed but not running.

Result: SSLVPN users are not able to connect to FortiGate as it does not meet the host check requirements.

SSL VPN debug logs:

Case 2: Software is installed and running.

Result: SSL VPN users can connect to FortiGate as it meets the host check requirement.