Allowing Guest SSL VPN Access

[Tech9]

Hi there.  We have contractors that work for our company, and to access some IP restricted URLS they need to NAT from our Public IP address.  In researching the best solution, everything tends to point to just "guest access" but I don't see anything for this specifically.  Id like to restrict them from accessing any internal resources (on their own VLAN if that's best) and shoot them straight back out the WAN port.  I know there are some smaht people that read these, so hoping maybe someone has some insight they might share.  Thanks in advance!

[distillednetwork]

Create a different SSL-VPN portal for then, a different user group and then just create the SSL-VPN to WAN policies with their user group.  If they need to use internal DNS for some reason make sure you give them access to that as well.

This article should give you some ideas and guidance on how to set it up:

https://docs.fortinet.com/document/fortigate/6.0.0/handbook/527388/multiple-user-groups-with-differe...