Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
systemgeek
Contributor

Which tunnel pool takes presidense?

Lets say I have the following portal config:

config vpn ssl web portal
edit "VPN_Contractors_General"
set tunnel-mode enable
set forticlient-download disable
set auto-connect enable
set keep-alive enable
set save-password enable
set ip-pools "VPN_Contractors_General"
config split-dns
edit 1
set domains "louis.net,louis.com,louisgod.com"
set dns-server1 10.100.74.21
set dns-server2 10.100.90.21
next
end
next
end
 
Here I have defined the IP-Pool I want these users to use as VPN_Contractors_General.  Now in my VPN SSL Settings I have the following:
config vpn ssl settings
set banned-cipher SHA1 SHA256 SHA384
set https-redirect enable
set servercert "star_louis_com_20250306"
set idle-timeout 900
set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"
set tunnel-ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"
set dns-server1 10.100.74.21
set dns-server2 10.100.90.21
set source-interface "port1"
set source-address "all"
set source-address6 "all"
set default-portal "full-access"
config authentication-rule
edit 2
set groups "TDS_FirewallSSO_Duo_VPN_Group"
set portal "VPN_Contractors_General"
next
end
end
 
In the SSL VPN Settings config is defined set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1".  Which is not the same as the ip pool defined in the VPN Portal.
 
The question is what IP Pool will be given to the users to make it through these 2 config?  I am kinda hopping the tunnel-ip-pool in the SSL VPN Settings is used if there is no ip pool configured in the portal. 
1 Solution
hbac
Staff
Staff

Hi @systemgeek,

 

"VPN_Contractors_General" will be used if users match "TDS_FirewallSSO_Duo_VPN_Group" group. Please refer to https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-specific-SSL-VPN-address-...

 

Regards, 

View solution in original post

1 REPLY 1
hbac
Staff
Staff

Hi @systemgeek,

 

"VPN_Contractors_General" will be used if users match "TDS_FirewallSSO_Duo_VPN_Group" group. Please refer to https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-specific-SSL-VPN-address-...

 

Regards, 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors