Restricting access to management console in FortiAuth

[ArifS]

I configured allow access from specific subnets under admin user configuration, but it still allows access from anywhere. Is there anything am I missing?

[ebilcari]

Even from the VPN, the access should be blocked if the source IP of the VPN users is not part of the subnet you have specified in admin user. Make sure you are not using NAT on the FW policy that allows VPN users access to FAC.

[ArifS]

i added another port with different subnet and use this subnet redirect through Fortiweb. I admin access on https. However when I tried to access through fortiweb it says that you are not allowed to access this site through host/domain. I checked the logs in Fortiweb and can't find any logs for FortiAuth server to find out what causing the issue. 

[ebilcari · Accepted solution]

FAC will check the request and refuse the connection if the URL will have a different domain. In your case I suspect from the browser you typed the URL of the the proxy. You have the option to allow all or manually specify the domains you can use on the end user browser to access FAC.