Fortinet Ssl Vpn Client

This chapter explains how to use and configure the web portal features. This chapter is written for end users as well as administrators.

The following topics are included:

Combining RADIUS/LDAP authentication and requiring specific client certificates for SSL VPN is possible. FortiGate cannot combine 'user peer' (required to specify what certificates match) and 'user LDAP/user RADIUS' and require login attempts to match both. To achieve this, follow the steps below: 1) User peer for certificate matching. Jan 08, 2020 A new SSL VPN driver was added to FortiClient 5.6.0 and later to resolve SSL VPN connection issues. If your FortiOS version is compatible, upgrade to use one of these versions. Latency or poor network connectivity can cause the default login timeout limit to be reached on the FortiGate. In; FortiOS 5.6.0 and later, use the following commands to. Provide malware protection and application firewall service. Enable the device to connect securely to the Security Fabric over either VPN (SSL or IPsec) or ZTNA tunnels, both encrypted. The connection to the Security Fabric can either be a. A new SSL VPN driver was added to FortiClient 5.6.0 and later versions to resolve various SSL VPN connection issues. If the FortiOS version is compatible, upgrade to use one of these versions. In addition, poor network connectivity can cause the FortiGate default login timeout limit to be reached. Connecting from FortiClient VPN client For FortiGate administrators, a free version of FortiClient VPN is available which supports basic IPsec and SSL VPN and does not require registration with EMS. This version does not include central management, technical support, or some advanced features.

Connecting to the FortiGate unit

Web portal overview

Portal configuration

Using the Bookmarks widget

Using the Quick Connection Tool

Using the SSL VPN virtual desktop

Using FortiClient

Connecting to the FortiGate unit

You can connect to the FortiGate unit using a web browser. The URL of the FortiGate interface may vary from one installation to the next. If required, ask your FortiGate administrator for the URL of the FortiGate unit, and obtain a user name and password. You can connect to the web portal using an Android phone, iPhone, or iPad. The FortiGate unit will display the content of the portal to fit the device’s screen.

In addition, if you will be using a personal or group security (X.509) certificate to connect to the FortiGate unit, your web browser may prompt you for the name of the certificate. Your FortiGate administrator can tell you which certificate to select.

To log into the secure FortiGate HTTP gateway

1. Using the web browser on your computer, browse to the URL of the FortiGate unit (for example, https://<FortiGate_IP_address>:443/remote/login). The FortiGate unit may offer you a self-signed security certificate. If you are prompted to proceed, select Yes.

A second message may be displayed to inform you that the FortiGate certificate distinguished name differs from the original request. This message is displayed because the FortiGate unit is attempting to redirect your web browser connection. You can ignore the message.

2. When you are prompted for your user name and password:
   • In the Name field, type your user name.
   • In the Password field, type your password.
3. Select Login.

The FortiGate unit will redirect your web browser to the FortiGate SSL VPN web portal home page automatically.

Web portal overview

After logging in to the web portal, the remote user is presented with a web portal page similar to the following:

Portal

Various widgets provide the web portal’s features:

• Session Information displays the elapsed time since login and the volume of HTTP and HTTPS traffic, both inbound and outbound.
• Quick Connection enables you to connect to network resources without using or creating a bookmark. l Download Forticlient provides access to the FortiClient tunnel application for various operating systems.
• Bookmarks provides links to network resources. You can use the administrator-defined bookmarks and you can

add your own bookmarks.

While using the web portal, you can select the Help button to get information to assist you in using the portal features. This information displays in a separate browser window.

When you have finished using the web portal, select the Logout button in the top right corner of the portal window.

Portal configuration

The SSL VPN web portal enables users to access network resources through a secure channel using a web browser. Fortinet administrators can configure log in privileges for system users and which network resources are available to the users.

Portal configuration

The portal configuration determines what the user sees when they log in to the portal. Both the system administrator and the user have the ability to customize the SSL VPN portal.

There are three pre-defined default web portal configurations available:

• full-access: Includes all widgets available to the user – Session Information, Tunnel Mode options, Connection Launcher, Remote Desktop, and Predefined Bookmarks. l tunnel-access: Includes Session Information and Tunnel Mode
• web-access: Includes Session Information and Predefined Bookmarks

You can also create your own web portal to meet your corporate requirements.

Portal settings

A web portal defines SSL VPN user access to network resources. The portal configuration determines what SSL VPN users see when they log in to the unit. Both the Fortinet administrator and the SSL VPN user have the ability to customize the web portal settings. Portal settings are configured in VPN > SSL-VPN Portals.

The following settings are available, allow you to configure general and security console options for your web portal.

Portal

Portal configuration

Predefined Bookmarks

Bookmarks are used as links to specific resources on the network. When a bookmark is selected from a bookmark list, a pop-up window appears with the requested web page. Telnet, RDP, and VNC pop up a window that requires a browser plug-in. FTP and Samba replace the bookmarks page with an HTML file-browser.

Note that the RDP/VNC web portals are not supported for the following platforms:

A web bookmark can include login credentials to automatically log the SSL VPN user into the web site. When the administrator configures bookmarks, the web site credentials must be the same as the user’s SSL VPN credentials. Users configuring their own bookmarks can specify alternative credentials for the web site.

Applications available in the web portal

Depending on the web portal configuration and user group settings, one or more of the following server applications are available to you through Predefined Bookmarks, as well as the Quick Connection widget:

• Citrix makes use of SOCKS so that the Citrix client can connect to the SSL VPN port forward module to provide the connection.
• FTP (File Transfer Protocol) enables you to transfer files between your computer and a remote host.

Using the Bookmarks widget

• HTTP/HTTPS accesses web pages.
• Port Forward provides the middle ground between web mode and tunnel mode. When the SSL VPN receives data from a client application, the data is encrypted and sent to the FortiGate unit, which then forwards the traffic to the application server. l RDP (Remote Desktop Protocol), similar to VNC, enables you to remotely control a computer running Microsoft Terminal Services.
• SMB/CIFS implements the Server Message Block (SMB) protocol to support file sharing between your computer and a remote server host.
• SSH (Secure Shell) enables you to exchange data between two computers using a secure channel.
• TELNET (Teletype Network emulation) enables you to use your computer as a virtual text-only terminal to log in to a remote host.
• VNC (Virtual Network Computing) enables you to remotely control another computer, for example, accessing your work computer from your home computer.

Some server applications may prompt you for a user name and password. You must have a user account created by the server administrator so that you can log in.

Group-based SSL VPN bookmarks

The administrator can add bookmarks for groups of users. SSL VPN will only output the matched group-name entry to the client. This can only be done via the CLI.

To add group-based SSL VPN bookmarks – CLI:

config vpn ssl web portal edit “portal-name” set user-group-bookmark enable*/disable

next

end

config vpn ssl web user-group-bookmark edit “group-name” config bookmark edit “bookmark1” ….

next

end

next

end

Using the Bookmarks widget

The Bookmarks widget shows both administrator-configured and user-configured bookmarks. Administrator bookmarks cannot be altered but you can add, edit or delete user bookmarks.

Bookmarks widget

The FortiGate unit forwards client requests to servers on the Internet or internal network. To use the web-portal applications, you add the URL, IP address, or name of the server application to the My Bookmarks list. For more information, see Adding bookmarks on page 48.

If you want to access a web server or telnet server without first adding a bookmark to the My Bookmarks list, use the Connection Tool instead. For more information, see Using the Bookmarks widget on page 47.

Adding bookmarks

You can add frequently used connections as bookmarks. Afterward, select any hyperlink from the Bookmarks list to initiate a session.

To add a bookmark

1. In the web portal, select New Bookmark.
2. Enter the following information:

48

Using the Bookmarks widget

3. Select OK and then select Done.

Group-based SSL VPN bookmarks

Fortinet Ssl Vpn Client

This CLI-only feature allows administrators to add bookmarks for groups of users. SSL VPN will only output the matched group-name entry to the client.

Syntax:

config vpn ssl web portal edit “portal-name” set user-group-bookmark enable*/disable

next

end

conf vpn ssl web user-group-bookmark edit “group-name” conf bookmark edit “bookmark1” ….

next

end

next

end

Fortinet Ssl Vpn Client Unable To Establish The Vpn Connection

Group-based SSL VPN bookmarks

This CLI-only feature allows administrators to add bookmarks for groups of users. SSL VPN will only output the matched group-name entry to the client.

Syntax:

config vpn ssl web portal edit <portal-name> set user-group-bookmark [enable | disable]

next

end

config vpn ssl web user-group-bookmark edit <group-name> config bookmark edit <bookmark1> …. next

Quick Connection Tool

end

next

end

Using the Quick Connection Tool

The Quick Connection Tool widget enables a user to connect to a resource when it isn’t a predefined bookmark.

You can connect to any type of server without adding a bookmark to the Bookmarks list. The fields in the Quick Connection Tool enable you to specify the type of server and the URL or IP address of the host computer.

See the following procedures:

l To connect to a web server on page 50 l To ping a host or server behind the FortiGate unit on page 50 l To start a Telnet session on page 51 l To start an FTP session on page 51 l To start an SMB/CIFS session on page 51 l To start an SSH session on page 52 l To start an RDP session on page 52 l To start a VNC session on page 52

Except for ping, these services require that you have an account on the server to which you connect.

When you use the Connection Tool, the FortiGate unit may offer you its self-signed security certificate. Select Yes to proceed. A second message may be displayed to inform you of a host name mismatch. This message is displayed because the FortiGate unit is attempting to redirect your web browser connection. Select Yes to proceed.

To connect to a web server

1. In Type, select HTTP/HTTPS.
2. In the Host field, type the URL of the web server.

For example: http://www.mywebexample.com or https://172.20.120.101

3. Select Go.
4. To end the session, close the browser window.

To ping a host or server behind the FortiGate unit

1. In Type, select Ping.
2. In the Host field, enter the IP address of the host or server that you want to reach. For example: 11.101.22
3. Select Go.

A message stating whether the IP address can be reached or not is displayed.

50

Using the Quick Connection Tool

To start a Telnet session

1. In Type, select Telnet.
2. In the Host field, type the IP address of the telnet host. For example: 11.101.12
3. Select Go.

A Telnet window opens.

4. Select Connect.
5. A telnet session starts and you are prompted to log in to the remote host.

After you log in, you may enter any series of valid telnet commands at the system prompt.

6. To end the session, select Disconnect (or type exit) and then close the TELNET connection window.

To start an FTP session

1. In Type, select FTP.
2. In the Host field, type the IP address of the FTP server. For example: 11.101.12
3. Select Go.

A login window opens.

4. Enter your user name and password and then select Login. You must have a user account on the remote host to log in.
5. Manipulate the files in any of the following ways:
   • To download a file, select the file link in the Name
   • To access a subdirectory (Type is Folder), select the link in the Name
   • To create a subdirectory in the current directory, select New directory. l To delete a file or subdirectory from the current directory, select its Delete
   • To rename a file in the current directory, select its Rename l To upload a file to the current directory from your client computer, select Upload. l When the current directory is a subdirectory, you can select Up to access the parent directory.
6. To end the FTP session, select Logout.

To start an SMB/CIFS session

1. In Type, select SMB/CIFS.
2. In the Host field, type the IP address of the SMB or CIFS server. For example: 11.101.12
3. Select Go.
4. Enter your user name and password and then select Login. You must have a user account on the remote host to log in.
5. Manipulate the files in any of the following ways:
   • To download a file, select the file link in the Name l To access a subdirectory (Type is Folder), select the file link in the Name column.
   • To create a subdirectory in the current directory, select New Directory. l To delete a file or subdirectory from the current directory, select its Delete l To rename a file, select its Rename icon.

Quick Connection Tool

• To upload a file from your client computer to the current directory, select Upload.
• When the current directory is a subdirectory, you can select Up to access the parent directory.

6. To end the SMB/CIFS session, select Logout and then close the SMB/CIFS window.

To start an SSH session

1. In Type, select SSH.
2. In the Host field, type the IP address of the SSH host. For example: 11.101.12
3. Select Go.
   • login window opens.
4. Select Connect.
   • SSH session starts and you are prompted to log in to the remote host. You must have a user account to log in. After you log in, you may enter any series of valid commands at the system prompt.
5. To end the session, select Disconnect (or type exit) and then close the SSH connection window.

Fortinet Ssl Vpn Client

To start an RDP session

1. In Type, select RDP.
2. In the Host field, type the IP address of the RDP host. For example: 11.101.12
3. Optionally, you can specify additional options for RDP by adding them to the Host field following the host address. See Using the Quick Connection Tool on page 50 for information about the available options. For example, to use a French language keyboard layout you would add the -m parameter:

10.11.101.12 -m fr

4. Select Go.

A login window opens.

5. When you see a screen configuration dialog, click OK.

The screen configuration dialog does not appear if you specified the screen resolution with the host address.

6. When you are prompted to log in to the remote host, type your user name and password. You must have a user account on the remote host to log in.
7. Select Login.

If you need to send Ctrl-Alt-Delete in your session, use Ctrl-Alt-End.

8. To end the RDP session, Log out of Windows or select Cancel from the Logon window.

To start a VNC session

1. In Type, select VNC.
2. In the Host field, type the IP address of the VNC host. For example: 11.101.12
3. Select Go.

A login window opens.

4. Type your user name and password when prompted to log in to the remote host. You must have a user account on the remote host to log in.
5. Select OK.

If you need to send Ctrl-Alt-Delete in your session, press F8, then select Send Ctrl-Alt-Delete from the pop-up menu.

6. To end the VNC session, close the VNC window.

Using the SSL VPN virtual desktop

Note that the RDP/VNC web portals are not supported for the following platforms:

Fortinet Ssl Vpn Client Plugin Chrome

Using the SSL VPN virtual desktop

The virtual desktop feature is available for Windows only. When you start an SSL VPN session, the virtual desktop replaces your normal desktop. When the virtual desktop exits, your regular desktop is restored. Virtual desktop information is encrypted so that no information from it remains available after your session ends.

To use the SSL VPN virtual desktop, simply log in to an SSL VPN that requires the use of the virtual desktop. Wait for the virtual desktop to initialize and replace your desktop with the SSL VPN desktop, which has a Fortinet SSL VPN logo as wallpaper. Your web browser will open to the web portal page.

You can use the virtual desktop just as you use your regular desktop, subject to the limitations that virtual desktop application control imposes. If it is enabled in the web portal virtual desktop settings, you can switch between the virtual desktop and your regular desktop. Right-click the SSL VPN Virtual Desktop icon in the taskbar and select Switch Desktop.

To see the web portal virtual desktop settings, right-click the SSL VPN Virtual Desktop icon in the taskbar and select Virtual Desktop Option.

When you have finished working with the virtual desktop, right-click the SSL VPN Virtual Desktop icon in the taskbar and select Exit. Select Yes to confirm. The virtual desktop closes and your regular desktop is restored.

Using FortiClient

Remote users can use FortiClient Endpoint Security to initiate an SSL VPN tunnel to connect to the internal network. FortiClient uses local port TCP 1024 to initiate an SSL encrypted connection to the FortiGate unit, on port TCP 10443. When connecting using FortiClient, the FortiGate unit authenticates the FortiClient SSL VPN request based on the user group options. the FortiGate unit establishes a tunnel with the client and assigns a virtual IP address to the client PC. Once the tunnel has been established, the user can access the network behind the FortiGate unit.

For information on configuring the FortiGate unit for SSL VPN connectivity, see Basic configuration on page 17.

For details on configuring FortiClient for SSL VPN connections, see the FortiClient documentation.

Fortinet Ssl Vpn Client Windows

Fortinet Ssl Vpn Client Download

Due to the global COVID-19 pandemic there have been many people switching from working in the office to telecommuting at home. This has required many individuals who are not typically used to working remote get used to operating a VPN client.

An issue we kept running into was a report that every day at a specific time the FortiClient VPN connection would drop. The odd thing was that this specific time of dropping was the same time for the same person, but not the same time across all users having the issue. Eventually we traced the issue back to someone who started work everyday at about 5:45 AM and everyday the connection would drop at 1:45 PM. This lead us to find out what the default SSL VPN timeout setting was for Fortigate SSL VPN access. Per below, the default timeout setting for an SSL VPN client was 28800 seconds – ie. 8 hours.

After some discussion we decided to increase the timeout value to 43200 – 12 hours.

Once the commands were entered on the Fortigate above these disconnect reports went silent.