Feature request: MotD for SSLVPN users

[AndyC]

Hi! Unsure of where to put this, being my first post on here, sorry if it's an inappropriate forum location to raise this.

Anyhoo, I'm planning a firmware upgrade on a couple of FortiGate appliances, which are live, supporting a number of SSL-VPN users (as an aside, what does the community think of upgrading that name to TLS-VPN?).

I'd love to be able to include some sort of global message on the VPN portals, such that all users would be notified of the planned upgrade, and potential downtime / disruption. 

I can type a portal message individually on each portal, but while the settings will take a lengthy input, the web portal itself only displays the first 32 characters of the message. This limit precludes its use for announcing anything other than "hi there! welcome" etc. Also were it available for longer free text, having to update several different portals would be a pain.

So, I'd love to see some kind of message / alert feature that could be displayed on all SSLVPN portals at once, something with enough room to say something like "Notice: Upcoming planned maintenance - system will be unavailable from (time) to (time) on (date). Please contact (so-and-so) or check (web page) for more information"

What are your thoughts?

[pminarik]

First, the admin stuff: NFRs are typically processed by informing your Fortinet sales/partner that you want a certain feature. This then gets processed further internally.

Back to your question: While there isn't a dedicated MotD feature as far as I know, off the top of my head, there's two options that could be utilized to implement something like that.

Web-mode: System > Replacement Messages > "SSL-VPN Portal Header". This is the topmost header of the VPN web-portal. If you carefully modify it, you can inject any desired announcements. The change will propagate to all VPN portals. (the only potential exception is VPN realms with separate customised replacement messages). Naturally, be very careful when modifying this - you don't want to completely break the portal. :)

Tunnel-mode: The XML configuration has an <on_connect> section which can be set to run a script on the endpoint as soon as it connects to the VPN. This could be used for example to simply always open a webpage with your MoTD, or you could run some more sophisticated script that would first check if there's anything new and only load the notification/website if yes. XML docs reference