SSL VPN on port 80

[soma043]

Can' t I change the default 10443 port to 80? For whatever reason, when I change the setting, I get no response when I try to connect. There must be a way to SSL VPN to the box without having to specify the port in the URL?

[soma043]

This is happening on two different boxes: 4.2.10 and 4.3.5

[soma043]

Changed it to 443. Appears to be working. Although some of the older documentation says that is a bad idea, I don' t find that same thing in the new documentation. Anyone know of any draw backs to using this? Other than the security by obscurity part?

[rwpatterson]

A question. You have over 65000 ports. Why use a well known one? What if you want to add a secure web server down the road...

[soma043]

Most of the end users aren' t familiar with using ports. This reduces support calls. I understand the logic behind using another port, makes total sense to me. And its just another layer of the defense in-depth. But we have to pick our battles, and this just isn' t one worth fighting.

[ede_pfau]

Of course there is an obvious drawback. If you use one of the standard ports 80 or 443 you lose the ability to remote-manage the Fortigate itself UNLESS you move the admin ports first. Second, as common web servers use these ports common web server attacks almost exclusively attack only ports 80 and 443. You' ll see that in the logs. I can' t see the advantage for your users either. You' ve got to give them the exact URL anyway, in your current setup the ' https://...' or they won' t find it. As users bookmark everything they won' t bother memorizing the URL anyway. Just my 2 cents...

[Carl_Wallmark]

one advantage of common ports is that almost all hotels and airports or whatever, allow port 80 and 443, and if you got " road warriors" you would want them to connect from all places. one more thing, you dont need to change the port 10443, leave it alone, and do a VIP instead, WAN1 on port 443 -> WAN1 on port 10443 (and of course choose another IP than the interface IP)

[TopJimmy]

ORIGINAL: Selective one more thing, you dont need to change the port 10443, leave it alone, and do a VIP instead, WAN1 on port 443 -> WAN1 on port 10443 (and of course choose another IP than the interface IP)

Could you expand on that a bit? We are dealing with a US federal government agency and they need to VPN into us to retrieve data and are complaining about the 10443 requirement. The Fortinet documentation states:

Do not select port number 443 for user access to the web portal login page. Port number 443 is reserved to support administrative connections to the FortiGate unit through the web-based manager.

So I' m hesitant to move it to 443.

[rwpatterson]

If you disable HTTPS access to the GUI from the outside, then I see no problem. Some folks here only administer the FGT from a VPN tunnel, so that would work.

[knut]

ORIGINAL: Selective one more thing, you dont need to change the port 10443, leave it alone, and do a VIP instead, WAN1 on port 443 -> WAN1 on port 10443 (and of course choose another IP than the interface IP)

What do you mean with choosing another IP than the Interface IP? Can' t I make a VIP from 443 to 10443 and use the wan IP?