HI,
I am planning to move my FortiGate SSL VPN to an external DHCP Server and have the following plan using a loopback interface following the FortiGate document link below.
I am unsure if my plan will work and if I have the correct Firewall Policies etc, does it look good?
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello Julian,
It look correct configuration, as you have mention ra-giaadr as loopback ip address so you will also get a ip according to that scope. Also checked connectivity between loopback address to dhcp server like ping from loopback to dhcp server ip address.
Hello Julian,
It look correct configuration, as you have mention ra-giaadr as loopback ip address so you will also get a ip according to that scope. Also checked connectivity between loopback address to dhcp server like ping from loopback to dhcp server ip address.
Thank you
Hi,
Thank you for reaching out. The diagram is more focused on howe you are building your local and sslvpn network. It does not show any concerns related how you are going to connect to the remote dhcp server also the article that provides the guiding steps should be straight forward. You can test and let us know if you ran into an issue or specific error to give you a more direct advise.
Thank you,
saleha
Thank you, I was not sure about the Firewall Rules and VIP's, the DHCP part is simple and handled by the DHCP GIADDR option.
Hello @julianhaines
I want to highlight one thing:
"Starting in v7.2.4, support was added to the SSL VPN for the DHCP GIADDR option. This option allows administrators to specify which DHCP scope should be used when allocating addresses to their SSL VPN users, whereas previously SSL VPN users could only receive IP addresses in the same subnet as the FortiGate's local DHCP server-facing interface (i.e. 10.10.12.0/24 on the FortiGate's port2 in the example topology)."
Make sure the FortiOS version is above 7.2.4 if you are planning to use this feature.
Other than that, everything looks good
Regards,
Varun
Thank you, I am running version 7.x and using the DHCP GIADDR option.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1696 | |
1091 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.