VPN FortiClient and Web VPN

[ddk1965]

Hello,

we are using FortiGate together with FortiClient. But we also discovered the web vpn access (port 10443).

In the VPN setting you have 3 profiles (Full-Tunnel-Web).

Is there a possibility to give to the people who use the FortiClient VPN the full access profile and when they are using a browser (web vpn) only the web profile?

Kr,

Danny

[gschmitt]

AFAIK No, you could use different users (one for web, another for client) but whichever portal you set highest in the list for the user is the one they are limited to.

But what is it exactly you want to achieve by this? I don't see any advantage.

[ddk1965]

gschmitt wrote:

AFAIK No, you could use different users (one for web, another for client) but whichever portal you set highest in the list for the user is the one they are limited to.

But what is it exactly you want to achieve by this? I don't see any advantage.

Because the FortiClient is only installed on company pc's and when they are using the web vpn the users are using their own or other non secure pc's. 

[gschmitt]

So you want to use different sets of policies depending on your level of trust?

Sorry, I think that can only be done via different users

[vmartin_FTNT]

The only way I can think of doing this would be to add device authentication to your policy. Then you could require that a company PC be used to connect to the full-access portal, while all other devices are sent to the web-access portal.

How feasible this would be depends on how many company PCs you would have to create definitions for.