I'm looking for a way to restrict VPNSSL access from a certain source IP for some users. As far as I know, I can do it but it will affect to all users. Is there any workaround to solve it?
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi llarena,
Modification : it's very bad solution ;)
I don't think the option exists. Source filtering is global to the SSL configuration.
If I had to do something unconventional. I will do for example:1) Add a different realm per user group (feature to be activated)2) Listen SSL VPN on a Loopback interface port 104433) Add a VIP on the WAN interface port 30443 to the loopback vpn ssl interface 104434) Add a rule with authorized wan source IPs to the loopback vip.5) Use another port for the VIP and another Realm for other users who do not have this limitation.
it will work as long as the port of unfiltered users is not known by other users.
I don't like my solution... but it works
Best regards
Hi Julien,
Thanks for the proposal. I'm afraid I cannot change the port. We're using standard 443 port because many places block non standard ports and we don't have any IP available to use it.
Bests,
Iñaki
Looks that there's an option at the authentication-rule that allows to add a source address:
config vpn ssl settings
config authentication-rule
edit N
set source-interface <interface-name>
set source-address <firewall-address-object>
But it's not working. Does anyone use it?
Created on 01-13-2023 05:40 AM Edited on 01-13-2023 05:41 AM
This is the right place. The restriction will apply to the user/group mentioned in the authentication-rule. Be aware that this restriction is applied at the time of logon (a logon attempt will result in failure if the src IP doesn't match, even if correct credentials are provided). It will not block TCP connection to the port. (a random client will be able to display the login page)
The VPN port responds to TCP SYN if it matches any IP from the list of permitted sources in the general SSL-VPN settings (any by default) and and any source in any authentication-rule (any by default).
Hi !
interesting these options, they don't appear in show full-configuration
thank you for this tip.
I go try in my lab
Best regards
I already tested it, but it doesn't block the vpn logon when connected from a different IP than the configured one. It let me log in as it wasn't configured.
It should work, and as far as I am aware, it does. Most likely a misconfiguration, or perhaps a bug, but I would recommend that you open a support case with the TAC to clarify/correct.
Care needs to be taken so that the relevant users/groups actually get matched to the correct portal with the correct filters. I've had plenty of tickets go through my hands with misconfigurations in these config sections.
Hi,
I have try in LAB and the filter by group is good. (version 7.2.3)
If my bad user log from another IP, i have a message rights denied.
Below, you can see my configuration :
FortiGate-40F (settings) # show
config vpn ssl settings
set servercert "Fortinet_Factory"
set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"
set tunnel-ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"
set source-interface "wan"
set source-address "NET_ACS" "NET_ACS-1"
set default-portal "full-access"
config authentication-rule
edit 1
set source-interface "wan"
set source-address "NET_ACS-1"
set groups "vpn_grp_1"
set portal "full-access"
next
edit 2
set source-interface "wan"
set source-address "NET_ACS_2"
set groups "vpn_grp_2"
set portal "full-access"
next
end
end
Do you have multiple public IPs on your WAN? You could conceivably create a new VDOM for these restricted users to connect to VPNSSL.
Then in your main VDOM create a local-in policy to block SSL VPN access from the source IPs.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1516 | |
1013 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.