SSL VPN avoid IP access

[Fort-zender]

Hi all,

Is there a way to restrict SSL-VPN access solely to the FQDN, disallowing users from accessing the web portal via the IP address? We prefer users to only use the FQDN for access.

OR

Can we use multiple server certificates that cover both IP and FQDN, eliminating certificate warnings?

Any lead?

[AEK]

Hello

I don't think FGT can deny VPN by IP and allow with FQDN.

On the other hand you can have one single private or public certificate for both IP and FQDN.

[mle2802]

Hi @Fort-zender,

You can use SAN certificate for both FQDN and IP.

[hbac · Accepted solution]

Hi @Fort-zender,

There is no way to allow FQDN and deny IP address as FortiGate always see traffic coming from IP addresses. FQDN is resolved at the client side.

To avoid certificate warning, you can add FortiGates IP address to the SAN field of the certificate: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Adding-SAN-Subject-Alternative-Name-while/...

Regards,