SSL VPN goes down when limiting the access

[danyal]

Hello,

I'm working on a pre-configured Fortigate firewall and seeing too many logs under VPN Events, most of them SSL VPN alerts. I realized these logs are coming from other countries than the intended country. After looking for some solutions to minimize the logs, I came across this "limit access to specific hosts" option. I tried to add my country as the hosts, however, after applying the policy, it doesn't let anyone connect to the VPN. What I'm seeing under VPN logs when a user tries to connect is "Action: tunnel-up - Reason: login successfully", and a few minutes after I'm getting this "Action: tunnel-down - Reason: User requested termination of service". Additionally, on the client side, it app doesn't even ask for a token verification and just drops the connection.

I hope someone can let me know the reason for this issue and what I should do next.

Secondly, I tried to revert SSL VPN to the way it was and apply the restriction under firewall policies. This time, I was able to connect to the VPN even though it took longer time to let me in, however, it didn't let me to connect to the local services that I was supposed to have access to.

Just to clarify, when there is no policy at all, the VPN works just fine, but my concern is the SSL VPN alert. Also, you may want to point out to Local In Policy. I'd say yes, there are policies there that I'm not aware of their purposes. One more thing that may or may not help is that there is a firewall policy to block some countries from accessing any interfaces, and this policy also doesn't get any hits.

Thank you!

[Toshi_Esumi]

You need to share us what exactly you configured (hopefully CLI) to let us understand why you got the result.

If you don't want to see those random hack attempts around the world in the log, only way is to use local-in-policy with geo blocking or specific subnet blocking. The firewall policies are examined after passing the local-in. If something is already configured, you need to understand what exactly it's doing to avoid conflict you're intending to configure.

Toshi 

[danyal]

Here is the VPN settings that is currently in effect:

config vpn ssl settings
set banned-cipher SHA1 SHA256 SHA384
set servercert "Fortinet_Factory"
set login-attempt-limit 3
set login-block-time 600
set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"
set tunnel-ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"
set dns-server1 *.*.*.*
set dns-server2 *.*.*.*
set port ***
set source-interface "wan1"
set source-address "all"
set source-address6 "all"
set default-portal "tunnel-access"
config authentication-rule
edit 1
set groups "SSLVPN Users"
set portal "tunnel-access"
next
end
end

There is no user defined Local-In-Policy.

And here is the firewall policy that causes the problem when I add the country to the source address.

config firewall policy
    edit 2
        set name "SSL VPN Tunnel"
        set uuid d9ca79f2-de35-****-d5f4-*****
        set srcintf "ssl.root"
        set dstintf "lan"
        set action accept
        set srcaddr "all" \\Stops working when changing it to a specific country
        set dstaddr "*** Subnets" "*** Subnets"
        set schedule "always"
        set service "***" \\Some services
        set utm-status enable
        set inspection-mode proxy
        set profile-protocol-options "custom-default"
        set ssl-ssh-profile "certificate-inspection"
        set av-profile "default"
        set webfilter-profile "default"
        set dnsfilter-profile "default"
        set ips-sensor "Default IPS Policy"
        set logtraffic all
        set groups "SSLVPN Users"
    next
end

[parthpatel]

Hello @danyal,

If you are looking to limit the access to specific hosts on SSL VPN then you need to define it only under the VPN settings and not on the firewall policy 

Please review below document as it goes in detailed steps to apply the same 
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Restricting-SSL-VPN-connectivity-from-cert...

Also you can review the best practice guide on SSL VPN as it goes over other options to help reduce the attempts 
https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-SSL-VPN-best-practices-guide/ta-...