Fortigate configuration and VPN access

[prince]

Hi Support,

we have configured Ads and dns server and the dns ip address is 10.1.0.100. dns is in lan segment. i have joined a client laptop to ad domain. now we are using fortigate firewall. i need to implement the firewall policy to the AD connected client laptop . and also when the Laptop users, take the laptop to there home or remote network i need the firewall policy to work when they connect to internet. and also the laptop should not have internet access without connecting to vpn. only by vpn they should have internet access when they are in remote place.,for this what i should do?can anyone help.

[sgawande]

Hi Prince , please use split tunneling option for locally traffic break out. You will get this option in SSL-VPN & IPsec VPN both

[prince]

Hi Sgawande. will this VPN automatically connect when the device is login in remote place.ie the user should not have internet access when they login in there home network. only after connecting with vpn they can able to browse

[sgawande]

Hi 

My bad , you need to disable split tunnel so that internal & internet traffic will go vai remote firewall & you can manage things vai policy as per requirement 

[prince]

Hi Sgawande,

when i connect the laptop in different work. internet is working without connecting to vpn. 

[prince]

can you share any solution for this. only by connecting vpn they should access internet. but now without connecting vpn ,they are accessing internet in remote. 

[sgawande]

Hi Prince 

You need to use VPN auto-connects and auto-reconnects features so that the users are always on the VPN whenever they have Internet access. This features available in License FortiClient VPN
Please do settings in PC so that whenever PC starts VPN will also begin so that you can control Internet traffic. 

[prince]

this is FortiClient endpoint management server VPN?

[sgawande]

Yes, FortiClient EMS 

[Debbie_FTNT]

Hey prince,

aside from the auto-connect features that sgawande mentioned (and those are the only way to force the computer to connect to VPN consistently), please also consider that for the VPN to even come up, your users will need internet access in the first place.

They will not be able to connect to the VPN if they don't have internet. After VPN is up, all further traffic can be routed through it, of course (disable split-tunneling), but before VPN is up control over the user's internet access is tricky.

If you use FortiClient and EMS, you can put in place restrictions- you could push out a default profile to FortiClients with very restrictive webfilter settings, for example, so that by default in non-connected state, FortiAuthenticator blocks a lot of website categories. But to my knowledge, blocking internet access completely is not possible through FortiClient, and if it was, then your users could never establish a VPN in the first place.

Cheers,

Deborah