Admin interface vs VPN portal port conflicts

[benatnordisk]

Hi!

   I have a VPN portal set up, and only on a specific interface (the one that faces the outside world).  I'd like to have the VPN portal be on port 80/443, but when I try to change it, I am told that port 80 and 443 are already in use by the Admin interface.  I don't understand why that should be a conflict, since the admin interface is not presented on the external-facing interface/IP address. 

   Is it possible somehow to have a VPN portal on ports 80/443 listening on one IP address, while the admin interface listens on ports 80/443 on a different IP?  If so, how can I accomplish this?  If not, why not?

Thanks in advance!!

[ede_pfau]

Hi,

and welcome to the forums.

The admin port settings for HTTP and HTTPS (and SSH) are global, that is, they apply to all interfaces and their corresponding IP addresses. If you want to use your SSL VPN portal on port 443 (80???) then you will have to move the admin ports to some other port, for instance 30443/30022.

Your question "if, then why?" made me smile. I guess it's just a design decision by Fortinet but then again I'm not working for them. This forum is for users from users, even though sometimes Fortinet employees participate.

I hope you can live with that fact. BTW, I change the admin ports on each and every FGT that I administer or configure. Browser shortcut will do the work for me.

[iJake]

Yes, welcome. As above, to change the ports you need to go to System > Admin > Settings and change the ports from there.

[AndreaSoliva]

Hi all

I saw this post and writing this post because event the post's here are actually correct there is a important thing to know and it is not known by a lot of persons/people etc.:

The reason why Fortinet implemented on 5.2.x a function which shows the conflict between the Admin port and/or VPN SSL Portal port is easy:

- The service on a FortiGate which provdes this ports for Admin Access and/or SSL-VPN Portal access is THE SAME FOR BOTH which means running under "System Services". Within this service IT IS FROM TECHNICAL POINT OF VIEW NOT possible to provide for both the same Port because BOTH ARE RUNNING within SAME SERVICE.

--> If this is understood there is a question: Can I use Port 443 for Admin Access and SSL-VPN?

= The answer is YES but what prerequisit is needed to do this configuration?

Prerequisit is = A Second Public IP (Absolut Neccessary=

If this prerequisit is given you can do the configuration which is actually something like a "workaround" which means:

--> Configuring the Second Public IP as a "secondary interface" on the wan as using a Destination NAT (VIP) on a loopback interface.

This configuration is described in the Knowledge Base Article:

http://kb.fortinet.com/kb/documentLink.do?externalID=FD35203

Within this article you will find a PDF "Config.pdf" (at the botton) which guides you step by step through the config.

Hope this helps to understand why this function of conflicting Admin and/or SSL VPN ports was implemented on 5.2 even it is existing for every FortiOS version like 5.0. If it is understood that both are defined in "System Service" the overall thing makes sense and is understandable :)

have fun....

Andrea

[iJake]

Not everyone will have a secondary IP, but if you do and you want to use it for admin access... power to you. It's only those who need to access the admin control panel who will be effected, so it's probably a easier to just change the ports of the admin panel to something else and use that.

[emnoc]

FWIW;

I wish  fortinet would made a VIP routing solution for this. I tried a while back with  mapping   a ext-intf with a public address and then mapped ip was the 127.0.0.1 loopback. I was not successful due to the rules  for fwpolicies don't allow for insertion a rule to the internal loopback { 127.0.0.1} . I believe theirs away that you can chew up one address and set it for a vpn-portal and have this terminated  and presented as a VIP. I will post whatever I come up with.

[Shawn_W]

Thanks for all the great info.  It's great to have a place like this.

[emnoc]

yes you can. It's called port precedence and you need to do it from the cli

e.g

GENKEN60D (settings) # set port-precedence enable GENKEN60D (settings) # set port 443 Warning: SSL VPN is using the same port as admin HTTPS access. You may have problem to access SSL VPN or admin HTTPS on certain interfaces depend on the port-precedence setting.  You could change the admin GUI port or the SSL VPN port to avoid the warning.

I would suggest that you "specificy" set the SSL vpn interfaces that you listen on and avoid the "any"

[PIDDLAW]

on page two of the config.pdf it says

Step 2  sub part e

Enter any unused IP address.

question, are they referring to any unused internal ip address? (like one from our lan / internal network ?)

or is this an ip that can be made up and is unique to the firewalls internal workings?

thanks

Dave