I don't think the option exists. Source filtering is global to the SSL configuration.
If I had to do something unconventional. I will do for example: 1) Add a different realm per user group (feature to be activated) 2) Listen SSL VPN on a Loopback interface port 10443 3) Add a VIP on the WAN interface port 30443 to the loopback vpn ssl interface 10443 4) Add a rule with authorized wan source IPs to the loopback vip. 5) Use another port for the VIP and another Realm for other users who do not have this limitation.
it will work as long as the port of unfiltered users is not known by other users.
This is the right place. The restriction will apply to the user/group mentioned in the authentication-rule. Be aware that this restriction is applied at the time of logon (a logon attempt will result in failure if the src IP doesn't match, even if correct credentials are provided). It will not block TCP connection to the port. (a random client will be able to display the login page)
The VPN port responds to TCP SYN if it matches any IP from the list of permitted sources in the general SSL-VPN settings (any by default) and and any source in any authentication-rule (any by default).
It should work, and as far as I am aware, it does. Most likely a misconfiguration, or perhaps a bug, but I would recommend that you open a support case with the TAC to clarify/correct.
Care needs to be taken so that the relevant users/groups actually get matched to the correct portal with the correct filters. I've had plenty of tickets go through my hands with misconfigurations in these config sections.
I have try in LAB and the filter by group is good. (version 7.2.3)
If my bad user log from another IP, i have a message rights denied.
Below, you can see my configuration :
FortiGate-40F (settings) # show config vpn ssl settings set servercert "Fortinet_Factory" set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1" set tunnel-ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1" set source-interface "wan" set source-address "NET_ACS" "NET_ACS-1" set default-portal "full-access" config authentication-rule edit 1 set source-interface "wan" set source-address "NET_ACS-1" set groups "vpn_grp_1" set portal "full-access" next edit 2 set source-interface "wan" set source-address "NET_ACS_2" set groups "vpn_grp_2" set portal "full-access" next end end
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.