Policy for SSL-VPN connections?

[generaltab]

Hello

I just replaced my old FortiGate 100 with a new FortiGate 90D. I’m trying to get SSL-VPN clients to work again.

I’ve added my LDAP server under User & Device > Authentication > LDAP Servers.

I’ve defined a VPN Users group under User > User Groups (and found my AD security group).

Now what should my policy look like to allow SSL connections and access to the internal network?

Thanks!

[Rewanta_FTNT]

in 5.2.X, you need to allow the sslvpn user group(from LDAP) to access the portal under sslvpn -->settings.

Firewall policy to allow sslroot -->internal network. 

in 5.0.X, if the ssvpn is enabled on wan1, then firewall policy from wan1 -->internal, action : sslvpn, usergrp:ssvpn-grp(from LDAP)

Firewall policy to allow sslroot -->internal network.

[generaltab]

Update: I'm able to establish the SSL-VPN with FortiClient from outside of my LAN, but not inside. Is an additional policy needed for FortiClient to work internally? Thanks again.

Thanks. I've added the VPN security group (from LDAP) under SSL > Settings, and created the ssl.root -> internal policy (attached). It appears to be closer to working now. However, FortiClient establishes the connection for only a few seconds before getting disconnected. I don't see anything in the logs (attached) to explain it..

date=2015-02-24 time=10:16:42 logid=0101039425 type=event subtype=vpn level=information vd="root" logdesc="SSL VPN tunnel down" action="tunnel-down" tunneltype="ssl-web" tunnelid=1501364964 remip=192.168.1.151 tunnelip=(null) user="steven" group="LDAP VPN Users" dst_host="N/A" reason="N/A" duration=9 sentbyte=0 rcvdbyte=0 msg="SSL tunnel shutdown"
date=2015-02-24 time=10:16:42 logid=0101039948 type=event subtype=vpn level=information vd="root" logdesc="SSL VPN tunnel down" action="tunnel-down" tunneltype="ssl-tunnel" tunnelid=1501364965 remip=192.168.1.151 tunnelip=10.212.134.200 user="steven" group="LDAP VPN Users" dst_host="N/A" reason="N/A" duration=3 sentbyte=83 rcvdbyte=132 msg="SSL tunnel shutdown"
date=2015-02-24 time=10:16:39 logid=0101039947 type=event subtype=vpn level=information vd="root" logdesc="SSL VPN tunnel up" action="tunnel-up" tunneltype="ssl-tunnel" tunnelid=1501364965 remip=192.168.1.151 tunnelip=10.212.134.200 user="steven" group="LDAP VPN Users" dst_host="N/A" reason="N/A" msg="SSL tunnel established"
date=2015-02-24 time=10:16:38 logid=0101039943 type=event subtype=vpn level=information vd="root" logdesc="SSL VPN new connection" action="ssl-new-con" tunneltype="ssl" tunnelid=0 remip=192.168.1.151 tunnelip=(null) user="N/A" group="N/A" dst_host="N/A" reason="N/A" msg="SSL new connection"
date=2015-02-24 time=10:16:35 logid=0101039943 type=event subtype=vpn level=information vd="root" logdesc="SSL VPN new connection" action="ssl-new-con" tunneltype="ssl" tunnelid=0 remip=192.168.1.151 tunnelip=(null) user="N/A" group="N/A" dst_host="N/A" reason="N/A" msg="SSL new connection"
date=2015-02-24 time=10:16:34 logid=0101039943 type=event subtype=vpn level=information vd="root" logdesc="SSL VPN new connection" action="ssl-new-con" tunneltype="ssl" tunnelid=0 remip=192.168.1.151 tunnelip=(null) user="N/A" group="N/A" dst_host="N/A" reason="N/A" msg="SSL new connection"
date=2015-02-24 time=10:16:34 logid=0101039943 type=event subtype=vpn level=information vd="root" logdesc="SSL VPN new connection" action="ssl-new-con" tunneltype="ssl" tunnelid=0 remip=192.168.1.151 tunnelip=(null) user="N/A" group="N/A" dst_host="N/A" reason="N/A" msg="SSL new connection"
date=2015-02-24 time=10:16:33 logid=0101039424 type=event subtype=vpn level=information vd="root" logdesc="SSL VPN tunnel up" action="tunnel-up" tunneltype="ssl-web" tunnelid=1501364964 remip=192.168.1.151 tunnelip=(null) user="steven" group="LDAP VPN Users" dst_host="N/A" reason="login successfully" msg="SSL tunnel established"
date=2015-02-24 time=10:16:33 logid=0101039943 type=event subtype=vpn level=information vd="root" logdesc="SSL VPN new connection" action="ssl-new-con" tunneltype="ssl" tunnelid=0 remip=192.168.1.151 tunnelip=(null) user="N/A" group="N/A" dst_host="N/A" reason="N/A" msg="SSL new connection"
date=2015-02-24 time=10:16:31 logid=0101039943 type=event subtype=vpn level=information vd="root" logdesc="SSL VPN new connection" action="ssl-new-con" tunneltype="ssl" tunnelid=0 remip=192.168.1.151 tunnelip=(null) user="N/A" group="N/A" dst_host="N/A" reason="N/A" msg="SSL new connection"