Technical Note: FortiGate - Assign fixed IP addresses over SSL VPN tunnel with FortiAuthenticator RADIUS service

[matanaskovic]

Description
This article describes:
- How to assign a fixed IP address in FortiAuthenticator for a specific user.
- How to configure web portal on FortiGate.
Solution
FortiGate Configuration.

- Edit web portal configured for fixed IPs:

# config vpn ssl web portal

    edit "test_FixIP"

        set tunnel-mode enable

        set ip-mode user-group               <----- Default paramter: range.

        set ip-pools "Range_Fix_IP"          <----- IP range.

    next

end

FortiAuthenticator Radius configuration.

Edit user configuration:
- User Management - > Local / Remote Users - > username XYZ > RADIUS Attributes and select 'Add'.

Vendor: Default
Attribute ID: Framed-IP-Address
Value:  <IP in the range defined on ip-pools>

Once configured, all users in the authentication group must have an assigned IP otherwise authentication will fail.

Related Articles

Technical Tip: Radius authentication with FortiAuthenticator