i'm on configuration of our new fortigate latest OS to allow our external companies to using the ssl-vpn client to get access to our internal systems.
We have several external companies and they need to have access to different internal systems.
Neither company is allowed to see the other's systems. All of them using one VPN-Pool IP-Range (exampl. 10.10.1.0/24)
User Login is based on LDAP Auth.
I have try this configuration:
1. Setup LDAP User/Groups
2. Setup ssl-vpn-portal with split tunneling "Enabled Based on Policy Destination", Source IP Pools = 10.10.1.0/24; No "Web Mode" Active.
3. SSL-VPN Settings "Listen Interface = WAN"; Tunnel Mode Client Settings "10.10.1.0/24"; Authentication/Portal Mapping "I add all VPN Groups from our external Companies"
4. Firewall Policy, I add for all external Companies one Rule with:
Incoming Interface = ssl-vpn tunnel interface
Outgoing Interface = Internal Port to our Systems
Source = The VPN-Pool 10.10.1.0/24 and the specific ldap-group
Destination = one of the internal System for the respective company.
That all! So i have one SSL-VPN-Setting and one SSL-VPN-Protal with one VPN-Pool for all external Companies but several Firewall Policy one for each Companie.
My Question is, is this configuration OK or do i need to do anything different?
For better understanding, nomaly u configure vpn under sophos UTM so we change at the moment our FW from Sophos to Fortigate.
Many thank's in advanced
Go to Solution.
Your setup is in general OK. It would work.
But I would configure different web portals and configure different realms for each external company in order to have granular control over each set of users.
As a result, you can apply different security policies to each external companyhttps://docs.fortinet.com/document/fortigate/6.2.0/cookbook/724772/ssl-vpn-multi-realmhttps://docs.fortinet.com/document/fortigate/6.0.0/handbook/795267/configuring-ssl-vpn-web-portals
View solution in original post
many thank's for your fast replay!
I have seen this with multi-realm but did'nt know realy for what we need that.
I will check this with deeper and will implement it.
I followed your recommendation and did the settings with Portal and realms for each company.Thanks again for the help!
You are welcome.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2023 Fortinet, Inc. All Rights Reserved.