SSL-VPN configuration for several external companies

[TBC]

Hello @All,

i'm on configuration of our new fortigate latest OS to allow our external companies to using the ssl-vpn client to get access to our internal systems.

We have several external companies and they need to have access to different internal systems.

Neither company is allowed to see the other's systems. All of them using one VPN-Pool IP-Range (exampl. 10.10.1.0/24)

User Login is based on LDAP Auth.

I have try this configuration:

1. Setup LDAP User/Groups

2. Setup ssl-vpn-portal with split tunneling "Enabled Based on Policy Destination", Source IP Pools = 10.10.1.0/24; No "Web Mode" Active.

3. SSL-VPN Settings "Listen Interface = WAN"; Tunnel Mode Client Settings "10.10.1.0/24"; Authentication/Portal Mapping "I add all VPN Groups from our external Companies"

4. Firewall Policy, I add for all external Companies one Rule with:

   Incoming Interface = ssl-vpn tunnel interface

   Outgoing Interface = Internal Port to our Systems

   Source = The VPN-Pool 10.10.1.0/24 and the specific ldap-group

   Destination = one of the internal System for the respective company.

That all! So i have one SSL-VPN-Setting and one SSL-VPN-Protal with one VPN-Pool for all external Companies but several Firewall Policy one for each Companie.

My Question is, is this configuration OK or do i need to do anything different?

For better understanding, nomaly u configure vpn under sophos UTM so we change at the moment our FW from Sophos to Fortigate.

Many thank's in advanced

TBC

[aahmadzada · Accepted solution]

Hi,

Your setup is in general OK. It would work.

But I would configure different web portals and configure different realms for each external company in order to have granular control over each set of users.

As a result, you can apply different security policies to each external company

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/724772/ssl-vpn-multi-realm
https://docs.fortinet.com/document/fortigate/6.0.0/handbook/795267/configuring-ssl-vpn-web-portals

Regards,

[TBC]

Hello,

many thank's for your fast replay!

I have seen this with multi-realm but did'nt know realy for what we need that.

I will check this with deeper and will implement it.

Many thank's!

R.

[TBC]

I followed your recommendation and did the settings with Portal and realms for each company.
Thanks again for the help!

[aahmadzada]

You are welcome.