- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can forticlient do this?
Hello,
In our environment we have a Fortigate 100 D, I'm planning to deploy in all laptop a VPN client, ideally at the end, would be great to get this done:
- Detect if user is in our facilities or not, there's no need to connect vpn if users are in the office. So if any user goes away, vpn tunnel should connect automatically.
- Should use AD credentials, as you all know, the more passwords we have, the more support requests IT department will suffer, all laptops are protected by Active Directory credentials, so somehow security in VPN connection should be automated.
The goal is to offer VPN benefits but without any user interaction...all traffic should be routed to VPN, even Internet connections
Anyone have any experience on this?
Thank you.
Solved! Go to Solution.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The FortiClient relies on "ON-net/OFF-net" detection to do the tunnel.
On-net/off-net can be based on:
1.
The network you are on, let´s say 192.168.1.0/24 is considered ON-net = no tunnel
You can also specify the MAC address of your default gateway if you are on the above network.
2.
The FortiGate can add an option in the DHCP request which the FortiClient will detect, no option = you are off-net and tunnel will go up
3.
You can also use that option in a third-party DHCP, like Windows Server, add the option and specify the S/N of a firewall.
You can also make the FortiClient ping different gateways and it will choose the one with lowest latency.
EDIT:
For password, you can save the password in FortiClient, however, the user needs to save the password the first time, there is no "single-sign-on". Well, there is an option to start the tunnel when you log in to the computer, then there is a "single-sign-on"
For routing, you only need to push out 0.0.0.0/0.0.0.0 as network, and all traffic will go through the tunnel, only make sure you have firewall policies on the firewall, like SSLVPN -> WAN1, Nat enabled and all your security profiles.
FCNSA, FCNSP
---
FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30B
FortiAnalyzer 100B, 100C
FortiMail 100,100C
FortiManager VM
FortiAuthenticator VM
FortiToken
FortiAP 220B/221B, 11C
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes you can do that. Fortinet has a pretty good video about this.
https://video.fortinet.co...n-with-forticlient-5-2
Mike Pruett
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you Mike, I'm going to eat that video right now!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Seems that is using Fortigate DHCP to detect if any computer is off the network, any chance to do this using Windows DHCP service instead of Fortigate?
Regards,
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I don't believe the on or off-net has anything todo with DHCP.
e.g
what if some one "static assigns" there laptop.
Ken
PCNSE
NSE
StrongSwan
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The FortiClient relies on "ON-net/OFF-net" detection to do the tunnel.
On-net/off-net can be based on:
1.
The network you are on, let´s say 192.168.1.0/24 is considered ON-net = no tunnel
You can also specify the MAC address of your default gateway if you are on the above network.
2.
The FortiGate can add an option in the DHCP request which the FortiClient will detect, no option = you are off-net and tunnel will go up
3.
You can also use that option in a third-party DHCP, like Windows Server, add the option and specify the S/N of a firewall.
You can also make the FortiClient ping different gateways and it will choose the one with lowest latency.
EDIT:
For password, you can save the password in FortiClient, however, the user needs to save the password the first time, there is no "single-sign-on". Well, there is an option to start the tunnel when you log in to the computer, then there is a "single-sign-on"
For routing, you only need to push out 0.0.0.0/0.0.0.0 as network, and all traffic will go through the tunnel, only make sure you have firewall policies on the firewall, like SSLVPN -> WAN1, Nat enabled and all your security profiles.
FCNSA, FCNSP
---
FortiGate 200A/B, 224B, 110C, 100A/D, 80C/CM/Voice, 60B/C/CX/D, 50B, 40C, 30B
FortiAnalyzer 100B, 100C
FortiMail 100,100C
FortiManager VM
FortiAuthenticator VM
FortiToken
FortiAP 220B/221B, 11C
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry Chris, got hung up and didn't see your responses. Selective and the others covered the bases though!
Mike Pruett
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you all!
I'm checking on all those points, I'm about to upgrade FortiOS to last stable version, meanwhile, I'm kind of stuck in Forticlient, I can just see basic options (just to create a vpn connection and get connected), acording to the video, some options must be enabled in Forticlient before exporting configuration and I can't see those options, I'll keep working on that.
I apreciate your help, thank you
Regards,
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Check out the client configurator. It will allow you customize the client using XML. After the client is customized you can deploy the customized version, with your desired settings.