SSl VPN port forward from Meraki to Fortinet 60E

[msaeed]

Hello every one,

My first post on the forum and I am pretty new to fortinet.

I have a scenario where we have Meraki MX64 which already has IPSEC client VPN configured on it.

We bought fortigate 60E and now we want to configure SSL VPN port forwarding from meraki to this fortigate appliance.

The idea is to get users who are connecting using home laptops instead of company provided to the fortigate applaicen isntead of Meraki as fortigate gives us more options to blcok ports etc, eventually we will replace our Meraki appliances soon with these forigates once but at the moment we just need to make sure that users connect to Fortigate using SSL VPN.

We only have one Public IP address and its on meraki.

I have configured the local interface LAN 1 with local subnet IP address and can access the Fortigate.

Should I connect WAN1 to meraki or LAN2, do I have to assign local subnet IP address and then use that IP in meraki for port forwarding.

Any other setting configurations I need to do to make it work.

Any help and assistance will be highly appreciated and looking forward to hear from the experts.

Thanks a lot..

[Toshi_Esumi]

If MX64's portforwarding works as any other FW's, that's what I would try and forward port 443, or other port you configure on the FGT side for SSL VPN. I wouldn't expect anything else needed to tweak other than the default route on the FGT is pointing to the MX64.

[msaeed]

Thanks Toshi for your reply.

At the moment this is what I have done.

Created a different vlan on meraki for Meraki port 2 as I was not able to assign it the same IP address as I have assigned to the LAN ports of fortigate.

Connected WAN1 of Fortigate to Meraki port 2 and assigned it an IP address from VLAN 

Connected LAN1 of Fortigate to the local switch and assinged it an IP address from local subnet.

I can ping Fortigate WAN1 interface from Meraki.

Customize the SSL port on fortigate to 4443 and Created a port forward rule to WAn1 of fortigate on 4443.

It does not work, any thing which I am missing here.

[Toshi_Esumi]

Only thing I can say is you should sniff at the FGT's incoming interface while a client is trying to connect. If you see it's coming in but the FGT is not replying anything, the FGT is likely not configured properly. But if nothing (of course port 4443) is coming in, the problem is on Meraki side and it's time to call in their support.

[msaeed]

I have managed to make the SSL VPN work but now want to know how to configure it with Server 2012 Radius server.

The cook book talks about the forti authenticate and forti token but we donot use that and I am not sure what those products are.

Can I integrate Fortigate with server 2012 radius server and allow specific AD groups to connect via VPN.

I found this doc but its for old OS and new cook book does not have any such thing in it.

https://cookbook.fortinet.com/ssl-vpn-radius-authentication/index.html.

[msaeed]

Well finished that as well, all good now, followed the above link and its wroking.

Guys please help and let me know if I can restrict client VPN users to only RDP, is this possible and if yes then please give me any pointers.

We only want VPN users to have access to 3389, they should only be able to do RDP once connected via VPN.