Help
Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Milaan
New Contributor II

Created on ‎05-17-2016 01:35 AM

SSL-VPN with Loopback Interface

Is it possible to get SSL-VPN with a loopback interface working? IPSEC is working but SSL-VPN not :(

Labels:
9590
0 Kudos
3 REPLIES 3
sguru
New Contributor

Created on ‎05-19-2021 02:36 AM

Is there any know working setup on SSL-VPN over the Loopback interface??

 

Regards,

Guru

6144
0 Kudos
emnoc
Esteemed Contributor III

Created on ‎05-19-2021 08:14 AM

That should be doable and has been done numerous times. Nothing is complex of different except you need a policy to get or allow access to the loopback interface since it's a loopback ;)

 

Here's what we've have done

 

e.g

 

/* create a loopback

 

config system interface

    edit "loop"

        set vdom "root"

        set ip 192.168.23.1 255.255.255.255

        set type loopback

        set snmp-index 9

    next

end

 

/* install policy on the interface(s) to get to the sslvpn listener basically the port that you need or using for sslvpn

 

/* custom service

 

FWHELBARCESP01 # show firewall service custom tcp8443 

config firewall service custom

    edit "tcp8443"

        set tcp-portrange 8443

    next

end

 

 

/ * policy to get to sslvpn  

FWHELBARCESP01 # show firewall policy 334

config firewall policy

    edit 334

        set uuid 4a75937a-b89b-51eb-4000-117989a354a2

        set srcintf "internal"

        set dstintf "loop"

        set srcaddr "all"

        set dstaddr "all"

        set action accept

        set schedule "always"

        set service "tcp8443"

    next

end

 

and lastly the sslvpn policy 

 

FWHELBARCESP01 # show firewall policy 1992

config firewall policy

    edit 1992

        set name "NET56263SSLVPN"

        set uuid 12b8d2d0-b89b-51eb-8e45-ad8027b7c710

        set srcintf "ssl.root"

        set dstintf "internal"

        set srcaddr "REDE_GROUP10"

        set dstaddr "wifi-hub"

        set action accept

        set schedule "always"

        set service "EMPRESA_SERVICIOS_GROUPO1"

        set nat enable

        set users "PAGO_PROCESADORES"

    next

end

 

just build the SSLVPN setting like any old SSLVPN but your interface is the named "loopback" interfaces that you create. Then advertise that into OSPF if your running a IGP routing protocol.

 

 

Ken Felix

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
6144
0 Kudos
sguru
New Contributor
In response to emnoc

Created on ‎05-19-2021 08:00 PM

Thanks for your response, Yes SSL-VPN working fine.

 

Regards,

Guru

6144
0 Kudos
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors
View all
Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.

Social Media
Security Research
Company
News & Articles
Contact Us

Copyright 2024 Fortinet, Inc. All Rights Reserved.