Trying to setup inbound rules via CLI, also need help setting up ssl vpn

[frankh076]

Thanks. Trying to help a friend setup a fortigate 60E. Totally different when compared to a cisco asa, pix or a checkpoint FW.  I need to figure out how to setup a rule that will allow a inbound connection from client A at ip xxx.xxx.xx.xxx on ports 2001, and 2011 to a internal host at 192.168.1.238.  I also would like to setup a vpn connection my home network, to allow me to login to the fortigate and use the web interface. any resources or a starting point would be helpful. thanks again

[emnoc]

I need to figure out how to setup a rule that will allow a inbound connection from client A at ip xxx.xxx.xx.xxx on ports 2001, and 2011 to a internal host at 192.168.1.238. 

    It's actually simple but here what I would do   config firewall service custom      edit port2001                 set tcp-range 2001       next     edit  port2011                set tcp-range 2011 end   config firewall address     edit myinsidehost           set subnet 192.168.1.238/32     next     edit theremotehost          set subnet xx.xx.xx.xx/32     end     config firewall policy     edit 0          set srcintf  WAN1          set dstint LAN          set srcaddr theremotehost          set dstadr myinsidehost          set service port2001 port2011          set action accept          set schedule  always          set logtraffic all        end   That's a basic fwpolicy from a fortiOS cli. If you need DNAT or security-profiles or SNAT, more configuration would be required

[xsilver_FTNT]

As emnoc pointed out, if 'inbound' mean DNAT, then keyword to look for is VIP (virtual IP).

Any connection through the firewall is governed by firewall or proxy policy, any connection to the firewall itself is goverened by trusted hosts, per port allowed services (allow access) and optionally via inbound policies.

For the sources I would suggest to start on http://docs.fortinet.com and check for guides per feature or technology, or check the cookbooks for pre-fabricated solutions and guides per desired outcom, config, design.

Basic solutions like VPN (SSL, IPSec or even L2TP) or VIP should be well documented in many variants and FortiOS version (be aware that there might be differences in config style between FortiOS Major/Minor versions).