Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
prince
New Contributor III

Fortigate configuration and VPN access

Hi Support,

we have configured Ads and dns server and the dns ip address is 10.1.0.100. dns is in lan segment. i have joined a client laptop to ad domain. now we are using fortigate firewall. i need to implement the firewall policy to the AD connected client laptop . and also when the Laptop users, take the laptop to there home or remote network i need the firewall policy to work when they connect to internet. and also the laptop should not have internet access without connecting to vpn. only by vpn they should have internet access when they are in remote place.,for this what i should do?can anyone help.

9 REPLIES 9
sgawande
New Contributor II

Hi Prince , please use split tunneling option for locally traffic break out. You will get this option in SSL-VPN & IPsec VPN both

prince
New Contributor III

Hi Sgawande. will this VPN automatically connect when the device is login in remote place.ie the user should not have internet access when they login in there home network. only after connecting with vpn they can able to browse

sgawande
New Contributor II

Hi 

My bad , you need to disable split tunnel so that internal & internet traffic will go vai remote firewall & you can manage things vai policy as per requirement 

prince
New Contributor III

Hi Sgawande,

when i connect the laptop in different work. internet is working without connecting to vpn. 

prince
New Contributor III

can you share any solution for this. only by connecting vpn they should access internet. but now without connecting vpn ,they are accessing internet in remote. 

sgawande
New Contributor II

Hi Prince 

You need to use VPN auto-connects and auto-reconnects features so that the users are always on the VPN whenever they have Internet access. This features available in License FortiClient VPN
Please do settings in PC so that whenever PC starts VPN will also begin so that you can control Internet traffic. 

prince
New Contributor III

this is FortiClient endpoint management server VPN?

sgawande
New Contributor II

Yes, FortiClient EMS 

Debbie_FTNT
Staff
Staff

Hey prince,

aside from the auto-connect features that sgawande mentioned (and those are the only way to force the computer to connect to VPN consistently), please also consider that for the VPN to even come up, your users will need internet access in the first place.

They will not be able to connect to the VPN if they don't have internet. After VPN is up, all further traffic can be routed through it, of course (disable split-tunneling), but before VPN is up control over the user's internet access is tricky.

 

If you use FortiClient and EMS, you can put in place restrictions- you could push out a default profile to FortiClients with very restrictive webfilter settings, for example, so that by default in non-connected state, FortiAuthenticator blocks a lot of website categories. But to my knowledge, blocking internet access completely is not possible through FortiClient, and if it was, then your users could never establish a VPN in the first place.

 

Cheers,

Deborah

+++ Divide by Cucumber Error. Please Reinstall Universe and Reboot +++
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors