Fortigate 60f as vpn server only

[cfuson]

I have a fortigate 60F that I used to use for my home lab. I have since replaced it with a different firewall/router (do to cost constraints). I would like to continue using the ssl vpn portion of the fortigate. Can that be done? and if so any instructions on setting it up?

Thanks

[kumarh]

If the FortiGate is not within your network, then you won't be able to use Fortigate SSL-VPN.

[cfuson]

i did get it connected to my network basically acting as a switch with it plugged in from port 5 to my network

[Toshi_Esumi]

In other words, just routing issues you need to solve:
1) how to make 60F's WAN accessible from the internet, like terminating the circuit by the 60F and put the new FW/router behind it, or do the opposite but set up port forwarding/VIPs on the current FW/router.
2) how to route LAN side once VPN client traffic hits the 60F then reach the current LAN on the current FW/router side.

But I don't see much benefit separating VPN to another device from the current FW/router unless the current one is not capable doing it, while it would add much more complexity and difficulty. At least I wouldn't recommend.

Toshi

PS. Or, if you're trying to learn from these routing issues, I would say go for it.

[cfuson]

Unfortunately the TP Link does not have VPN capability. please see my setup listed below 

[kumarh]

Could you please share your network topology? What is the role of Fortigate in your network?

[cfuson]

Current setup is TP Link Deco Mesh WiFi System connected to my Inet modem. I have my main switch plugged into the TP Link and my servers plugged into it. I plugged the 60F into that switch as well and have it set with a static IP (on my network). I can access it's web admin page with no issues. I set port forwarding on the TP Link for TCP port 443 to forward to the static IP of the 60F.

I then tried to connect to it from my iPhone (wifi turned off) as I used to be able to do, but it never connects 

[Toshi_Esumi]

So it's SSL VPN using FortiClient VPN app? What interface of 60F you assigned a static IP and connected to the switch? WAN1? Do you see traffic coming in WAN1 when you sniff like "diag sniffer packet wan1 'tcp and port 443'"?

Toshi

[cfuson]

I assigned the static IP to the internal interface. should I remove i from there and set it to dhcp, then set the wan port to have static?

[Toshi_Esumi]

Which interface you configured to receive the SSL VPN? Or you set "any"? If you set SSL VPN settings to listen to wan1, you need to connect wan1.
If you want to use internal instead, you have to specify "internal" or "any" to accept ssl vpn at any interface.
Then sniff if it's coming.
You still need to set up proper policy to allow LAN access from ssl.root to wan1 if you use wan1.

Toshi