These Complicated VPN terms

[BusinessUser]

full-access
tunnel-access
web-access
tunnel mode
web mode

Can anyone explain these vpn terms to me?

E.g. what is the difference between tunnel access and tunnel mode?

[maulishshah]

Hi Team,

Regarding your question:

"Full-access," "web-access," and "tunnel-access" are the built-in portals.

If you refer to the following article: https://docs.fortinet.com/document/fortigate/5.4.0/cookbook/912474/ssl-vpn-using-web-and-tunnel-mode, you'll find that each portal comes with a separate configuration.

Full-access users can access both tunnel mode and the web mode.

Tunnel mode means the users are connecting through the FortiClient software, while web mode is for someone who doesn't require FortiClient, and they can visit the external URL to work.

Here are the articles for your reference:

Tunnel mode: https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/954097/ssl-vpn-tunnel-mode

Web mode: https://docs.fortinet.com/document/fortigate/6.2.15/cookbook/579694/ssl-vpn-web-mode-for-remote-user

I hope this helps!

[pminarik]

"Tunnel mode" and "web mode" are the two ways of accessing Fortinet's SSL-VPN.

"web mode" is accessed by a regular browser - you log into it like to a regular website. It is essentially a reverse proxy witha web-GUI, typically used to access internal websites through it. It also has a builtin client for RDP, SSH, SMB/CIFS protocols (non-exhaustive list). You can access internal resources only through this "website", not through any other browser or app on your PC/device.

"tunnel mode" is accessed via a specific app installed on your PC/device - FortiClient. The app establishes a tunnel to the FortiGate and automatically modifies the routing table on the device to route certain traffic (configurable) through the tunnel. Because it changes routing on the client, the tunelling is applicable to all applications on the client PC/device.

full-access / tunnel-access / web-access are the names of the default SSL-VPN profiles. You can modify them, delete them, or create your own.

By default, full-access has both tunnel mode and web mode enabled, tunnel-access has only tunnel mode enabled, and web-access has only web mode enable. As already noted, this is only true for the default, non-modified configuration, and can be changed at any time by the administrator (you, presumably).

[BusinessUser]

For RDP I am using remote desktop.

For SSH I am using putty.

I just put a firewall policy to allow it through.

What has firewall policy got to do with web mode?

[pminarik]

In your specific scenario, as you decribed it, using specific RDP and SSH apps implies that you are using FortiClient for SSL-VPN, which means tunnel-mode is used. Web-mode is therefore irrelevant for you, and can be disabled (assuming no other user is using it).

In general, both web-mode and tunnel-mode require relevant firewall policies to exist in order to function. So the relation is "no firewall policy" => "no VPN" (irrespective of using web-mode or tunnel-mode).

[BusinessUser]

Enlighten me how does one SSH or RDP into another site using web mode?

I have only used applications so far

[pminarik]

The web-mode portal includes a web-based implementation of RDP/SSH/etc client.

[BusinessUser]

Sorry can you give me an example?

[pminarik]

For a quick demo:

1, Log into the web-mode portal (connecting to your SSL-VPN's IP:port in browser)

2, Click "Quick Connection"

3, Choose SSH (that's the easiest one to try quickly)

4, Fill in the host field

5, Click launch
6, You should be prompted for a password and then have an SSH connection to the server you chose.

Assumptions for this to work:

- Your user gets matched to a VPN portal with web-mode enabled

- The VPN portal has "Show Connection Launcher" enabled for webmode

- A firewall policy exists that will allow this traffic (SSH from your SSL-VPN user, to the SSH port of your chosen server)

- The SSH server is willing to accept this connection

https://docs.fortinet.com/document/fortigate/7.0.12/administration-guide/763614/quick-connection-too...

[BusinessUser]

I dont understand this sentence in web mode:

"typically used to access internal websites through it. It also has a builtin client for RDP, SSH, SMB/CIFS protocols (non-exhaustive list). You can access internal resources only through this "website", not through any other browser or app on your PC/device."

Isnt VPN used to access resources regardless of web mode or tunnel mode?