A note, you can also fully edit your VPN login page to reflect your company logo, etc. You can customize the page to any specification. I added the IP Pool for the clients to get tunnel addresses. We are using the “Full-access” Portal, this is just a name. Both will launch in a Java applet window and allow you access to RDP/SMB. Other great uses are RDP session, and file shares. If a user is traveling or at a hotel they might not have this access. This is great because installing the VPN client which allows tunnel mode requires admin access to the PC. For example, we have an internal sharepoint site for users, by placing a link on the portal, users they just have to click and Whola, instant access. It is a great place to add book marks, shortcuts for RDP, or info for users. The portal is the landing page of the SSL VPN. If I wanted to get even more specific and say authenticate against a security group within LDAP I would just modify the remote server portion of the user group to add that. If I wanted to add a LDAP/Radius server to authenticate against, I could just add the remote server. I am creating a user group call SSL_VPN and in this case its just local.
I would go ahead and create a User group so that you can add any local, radius, or ldap users into it in the future. You can use just individual users, or groups to authenticate to within the VPN policy. In this example I am just using local accounts, but using LDAP or Radius is a much better option. You can authenticate VPN users against LDAP, Radius, or local accounts. There are many different ways to configure authentication within the device. Notice our device is ssl.root, and that removes our needed gateway. Since the SSL VPN is a “interface” we will route our subnet across of it. If there are multiple subnets it might be better to add an address object group. This is our internal network that we want the remote user to be able to access. Then we need to create another object for our Protected subnet. I would recommend using a crazy private IP subnet as to not conflict with Home/work local subnets. We will create an address object with the Subnet of our SSL VPN clients. Create policy to allow traffic from the Lan to SSL, and from SSL to Lan. Create the SSL VPN policy, including the projected subnet for Split Tunnel.ħ. Create Users/User group for user authenticationĦ.
Create Address object for SSL Subnet and Internal networksģ. A lot of companies (hotels, hospitals) and educational institutions block IPSEC from leaving the network which stops your remote access VPN from connecting.ġ. Another great benifit is in the protocol itself, SSL is almost never blocked by outbound firewall policies. For example if you have a business with users traveling all the time, you might have a certain portal for one group of users and have their internal bookmarks and file shares, and completely different portal for office staff users. You can also utilize the VPN to get select information to users based on their AD security group. No crazy licensing for SSL VPN as with Cisco and Sonicwall. The SSL VPN is one of the best features of the device, it has an open license, so you can have as many people connect as the device hardware supports. In this example we are creating a Split tunnel VPN, and enabling Tunnel mode. This entry will show the needed steps to create a SSL VPN via the web interface.Ĭreating the SSL VPN has many working parts that come together to make one of the best Remote access VPNs out there. The best information available for anything fortinet is always found at.
0 kommentar(er)
