Fortinet Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
TBC
Contributor

SSL-VPN configuration for several external companies

Hello @All,

 

i'm on configuration of our new fortigate latest OS to allow our external companies to using the ssl-vpn client to get access to our internal systems.

We have several external companies and they need to have access to different internal systems.

Neither company is allowed to see the other's systems. All of them using one VPN-Pool IP-Range (exampl. 10.10.1.0/24)

User Login is based on LDAP Auth.

I have try this configuration:

1. Setup LDAP User/Groups

2. Setup ssl-vpn-portal with split tunneling "Enabled Based on Policy Destination", Source IP Pools = 10.10.1.0/24; No "Web Mode" Active.

3. SSL-VPN Settings "Listen Interface = WAN"; Tunnel Mode Client Settings "10.10.1.0/24"; Authentication/Portal Mapping "I add all VPN Groups from our external Companies"

4. Firewall Policy, I add for all external Companies one Rule with:

   Incoming Interface = ssl-vpn tunnel interface

   Outgoing Interface = Internal Port to our Systems

   Source = The VPN-Pool 10.10.1.0/24 and the specific ldap-group

   Destination = one of the internal System for the respective company.

 

That all! So i have one SSL-VPN-Setting and one SSL-VPN-Protal with one VPN-Pool for all external Companies but several Firewall Policy one for each Companie.

 

My Question is, is this configuration OK or do i need to do anything different?

For better understanding, nomaly u configure vpn under sophos UTM so we change at the moment our FW from Sophos to Fortigate.

 

Many thank's in advanced

TBC

 

1 Solution
aahmadzada
Staff
Staff

Hi,

Your setup is in general OK. It would work.

But I would configure different web portals and configure different realms for each external company in order to have granular control over each set of users.


As a result, you can apply different security policies to each external company

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/724772/ssl-vpn-multi-realm
https://docs.fortinet.com/document/fortigate/6.0.0/handbook/795267/configuring-ssl-vpn-web-portals

 

Regards,

 

View solution in original post

4 REPLIES 4
aahmadzada
Staff
Staff

Hi,

Your setup is in general OK. It would work.

But I would configure different web portals and configure different realms for each external company in order to have granular control over each set of users.


As a result, you can apply different security policies to each external company

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/724772/ssl-vpn-multi-realm
https://docs.fortinet.com/document/fortigate/6.0.0/handbook/795267/configuring-ssl-vpn-web-portals

 

Regards,

 

TBC
Contributor

Hello,

many thank's for your fast replay!

I have seen this with multi-realm but did'nt know realy for what we need that.

I will check this with deeper and will implement it.

 

Many thank's!

R.

TBC
Contributor

I followed your recommendation and did the settings with Portal and realms for each company.
Thanks again for the help!

 

aahmadzada

You are welcome.