Which tunnel pool takes presidense?

[systemgeek]

Lets say I have the following portal config:

config vpn ssl web portal

edit "VPN_Contractors_General"

set tunnel-mode enable

set forticlient-download disable

set auto-connect enable

set keep-alive enable

set save-password enable

set ip-pools "VPN_Contractors_General"

config split-dns

edit 1

set domains "louis.net,louis.com,louisgod.com"

set dns-server1 10.100.74.21

set dns-server2 10.100.90.21

next

end

next

end

Here I have defined the IP-Pool I want these users to use as VPN_Contractors_General.  Now in my VPN SSL Settings I have the following:

config vpn ssl settings

set banned-cipher SHA1 SHA256 SHA384

set https-redirect enable

set servercert "star_louis_com_20250306"

set idle-timeout 900

set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"

set tunnel-ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"

set dns-server1 10.100.74.21

set dns-server2 10.100.90.21

set source-interface "port1"

set source-address "all"

set source-address6 "all"

set default-portal "full-access"

config authentication-rule

edit 2

set groups "TDS_FirewallSSO_Duo_VPN_Group"

set portal "VPN_Contractors_General"

next

end

end

In the SSL VPN Settings config is defined set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1".  Which is not the same as the ip pool defined in the VPN Portal.

The question is what IP Pool will be given to the users to make it through these 2 config?  I am kinda hopping the tunnel-ip-pool in the SSL VPN Settings is used if there is no ip pool configured in the portal. 

[hbac · Accepted solution]

Hi @systemgeek,

"VPN_Contractors_General" will be used if users match "TDS_FirewallSSO_Duo_VPN_Group" group. Please refer to https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-specific-SSL-VPN-address-...

Regards,