In this example, the Destination is 192.168.1.0.The source address references the tunnel IP addresses that the remote clients are using. Set the Source to SSLVPN_TUNNEL_ADDR1 and group to sslvpngroup.

Incoming interface must be SSL-VPN tunnel interface(ssl.root).

In this example, sslvpn split tunnel access.

Create new Authentication/Portal Mapping for group sslvpngroup mapping portal my-split-tunnel-portal.

In Authentication/Portal Mapping All Other Users/Groups, set the Portal to tunnel-access.

Choose a certificate for Server Certificate.

Optionally, set Restrict Access to Limit access to specific hosts, and specify the addresses of the hosts that are allowed to connect to this VPN.

For Listen on Interface(s), select wan1.

Leave undefined to use the destination in the respective firewall policies.

Select Routing Address to define the destination network that will be routed through the tunnel.

Go to VPN > SSL-VPN Portals to create a tunnel mode only portal my-split-tunnel-portal.

Go to User & Device > User Groups to create a group sslvpngroup with the member sslvpnuser1.

Go to User & Device > User Definition to create a local user sslvpnuser1.

Go to Policy & Objects > Address and create an address for internal subnet 192.168.1.0.

Edit port1 interface (or an interface that connects to the internal network) and set IP/Network Mask to 192.168.1.99/255.255.255.0.

Go to Network > Interfaces and edit the wan1 interface.

VPN ConfigurationĬonnect to the FortiGate VM using the Fortinet GUI. This article details an example SSL VPN configuration that will allow a user to access internal network infrastructure while still retaining access to the open internet. SSL or Client VPNs are used to grant VPN access to users without an enterprise firewall, such as remote workers or employees at home.

Fortinet vpn client setup