Restrict VPNSSL access per user

[Ilarena]

I'm looking for a way to restrict VPNSSL access from a certain source IP for some users. As far as I know, I can do it but it will affect to all users. Is there any workaround to solve it?

[Julien87]

Hi llarena,

Modification : it's very bad solution ;)

I don't think the option exists. Source filtering is global to the SSL configuration. 

If I had to do something unconventional. I will do for example:
1) Add a different realm per user group (feature to be activated)
2) Listen SSL VPN on a Loopback interface port 10443
3) Add a VIP on the WAN interface port 30443 to the loopback vpn ssl interface 10443
4) Add a rule with authorized wan source IPs to the loopback vip.
5) Use another port for the VIP and another Realm for other users who do not have this limitation.

it will work as long as the port of unfiltered users is not known by other users.

I don't like my solution... but it works

Best regards

[Ilarena]

Hi Julien,

Thanks for the proposal. I'm afraid I cannot change the port. We're using standard 443 port because many places block non standard ports and we don't have any IP available to use it.

Bests,

Iñaki

[Ilarena]

Looks that there's an option at the authentication-rule that allows to add a source address:

config vpn ssl settings
config authentication-rule
edit N
set source-interface <interface-name>
set source-address <firewall-address-object>

But it's not working. Does anyone use it?

[pminarik]

This is the right place. The restriction will apply to the user/group mentioned in the authentication-rule. Be aware that this restriction is applied at the time of logon (a logon attempt will result in failure if the src IP doesn't match, even if correct credentials are provided). It will not block TCP connection to the port. (a random client will be able to display the login page)

The VPN port responds to TCP SYN if it matches any IP from the list of permitted sources in the general SSL-VPN settings (any by default) and and any source in any authentication-rule (any by default).

[Julien87]

Hi !

interesting these options, they don't appear in show full-configuration

thank you for this tip.

I go try in my lab

Best regards

[Ilarena]

I already tested it, but it doesn't block the vpn logon when connected from a different IP than the configured one. It let me log in as it wasn't configured.

[pminarik]

It should work, and as far as I am aware, it does. Most likely a misconfiguration, or perhaps a bug, but I would recommend that you open a support case with the TAC to clarify/correct.

Care needs to be taken so that the relevant users/groups actually get matched to the  correct portal with the correct filters. I've had plenty of tickets go through my hands with misconfigurations in these config sections.

[Julien87]

Hi,

I have try in LAB and the filter by group is good. (version 7.2.3)

If my bad user log from another IP, i have a message rights denied.

Below, you can see my configuration :

FortiGate-40F (settings) # show
config vpn ssl settings
set servercert "Fortinet_Factory"
set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"
set tunnel-ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"
set source-interface "wan"
set source-address "NET_ACS" "NET_ACS-1"
set default-portal "full-access"
config authentication-rule
edit 1
set source-interface "wan"
set source-address "NET_ACS-1"
set groups "vpn_grp_1"
set portal "full-access"
next
edit 2
set source-interface "wan"
set source-address "NET_ACS_2"
set groups "vpn_grp_2"
set portal "full-access"
next
end
end

[gfleming]

Do you have multiple public IPs on your WAN? You could conceivably create a new VDOM for these restricted users to connect to VPNSSL.

Then in your main VDOM create a local-in policy to block SSL VPN access from the source IPs.