OK 78 Remote+Access+VPN1

Remote-Access VPNs:
o Enable users to work from remote locations such as their homes & other premises.
o Remote-Access VPNs connect client devices to LAN over the Internet infrastructure.
o Individual hosts or clients access a company network securely over the Internet.
o Each host typically has the VPN client software loaded or uses a web-based client.
o Whenever the host send any information, the VPN client software encapsulates it.
o Whenever the host send any information, the VPN client software also encrypts it.
o It allows individual users to establish secure connections with a remote network.
o Remote-Access VPN tunnels are formed between a VPN device and an end-user PC.
o The remote user requires the FortiGate Virtual Private Network (VPN) client software.
o Remote access Virtual Private Network connect individual users to private networks.
o Remote-access Virtual Private Network connects individual host to company Network.
IPSec VPN:
o Data path between a user’s computer & private network through VPN is called tunnel.
o The tunnel runs between the FortiClient application on the user’s PC, or a FortiGate unit.
o Or the tunnel other network device and the FortiGate unit on the office private network.
o IPsec is typically used for site-to-site tunnels but is suitable for host-to-site settings as well.
o Always need software client for IPsec on host which is this case could be again FortiClient.
o FortiClient supports both IPsec & SSL VPN connections to your network for remote access.
o All the protocols are supported across the Internet Protocol Security (IPSec) VPN tunnel.
SSL VPN:
o SSL VPN stands for Secure Sockets Layer virtual private network, called web-based VPN.
o Provides SSL VPN remote-access connectivity from almost any Internet-enabled location.
o SSL Virtual Private Network using only web browser that natively supports SSL encryption.
o You can use SSLVPN client-less, that is, from any browser, called web mode or portal mode.
o SSLVPN in tunnel mode allows to use any protocol on remote side need FortiClient App.
IPSec VPN SSL VPN

IPSec Tunnel HTTPs Tunnel (SSL/TLS Layer)
FortiClient + FortiGate Browser/FortiClient + FortiGate
FortiGate + FortiGate Log in through HTTPs Web Page
FortiGate + Third Pary IPSec VPN Gateway Virtual Adaptor FortiClient
Site-to-Site VPN FortiClient
IP Based Application Web Based Applications
Full Configuration Require Only Web Broswer
Operates at Layer 4 - 7 Operates at Layer 3
1 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 056 430 3717

SSL VPN Web Portal Lab:
Remote Access VPN

Outside Layer 3 Interface Port2– 192.168.122.100/24
Inside Layer 3 Interface Port3 - 192.168.1.100/24
Local Network 192.168.1.0/24
Remote Network 10.212.134.200 - 10.212.134.210
Management IP Address Port1-192.168.140.100/24
Telnet-Server IP Address 192.168.1.10/24
Web-Server IP Address 192.168.1.20/24
FTP-Server IP Address 192.168.1.30/24
Devices Configuration
Remote-PC1 Webterm # DHCP config for eth0
Docker Configuration auto eth0
iface eth0 inet dhcp
Remote-PC2 Server 12 Through DHCP
Configuration
Telnet-Server Router Telnet-Server(config)#interface e0/0
Configuration Telnet-Server(config-if)#ip address 192.168.1.10 255.255.255.0
Telnet-Server(config-if)#shutdown
Telnet-Server(config)#ip route 0.0.0.0 0.0.0.0 192.168.1.100
Telnet-Server(config)#line vty 0 4
Telnet-Server(config-line)#password 123
Telnet-Server(config-line)#login
Telnet-Server(config-line)#transport input all
Telnet-Server(config)#enable password 123

Web-Server WordPress # Static config for eth0
Configuration auto eth0
iface eth0 inet static
address 192.168.1.20
netmask 255.255.255.0
gateway 192.168.1.100
up echo nameserver 8.8.8.8 > /etc/resolv.conf
FTP-Server Toolbox # Static config for eth0
Configuration auto eth0
iface eth0 inet static
address 192.168.1.30
netmask 255.255.255.0
gateway 192.168.1.100
up echo nameserver 8.8.8.8 > /etc/resolv.conf
Login to Firewall:
First Console to Firewall, find out the IP address to login
FOSVM1PEQIUKIGDD: admin
Password:
You are forced to change your password, please input a new password.
New Password:***
Confirm Password:***
Welcome !
Login to FortiGate Firewall type https://192.168.140.100 in any browser.

Configure Interfaces:
Go to Network>Interfaces select mgmt Click Edit. In Alias type MGMT, change the Address
Mode to Manual type IP/Netmask 192.168.140.100/24, , in Administrative access checked PING
leave all the rest of configuration default & press OK.
select port1 Click Edit in Alias type WAN, change the Address Mode to Manual type IP/Netmask
192.168.122.100/24, in Administrative access only checked PING leave all the rest of
configuration default & press OK.
Go to Network>Interfaces select port2 Click Edit in Alias type LAN, change the Address Mode to
Manual type IP/Netmask 192.168.1.100/24, in Administrative access checked PING and leave
all the rest of configuration default & press OK.
Configure Default Route:

To create a new default route, go to Network > Static Routes and create a static route for ISP.
Set Destination to Subnet and leave the destination IP address set to 0.0.0.0/0.0.0.0. Set
Gateway to the IP address provided by your ISP and Interface to the Internet-facing interface in
my case 192.168.122.2 which my Internet Router Gateway. Set the Interface to the WAN
interface. Press OK to Save the changes.

DNS Configuration:
Go to Network > DNS , click on Specify and enter in primary / secondary DNS servers. In Primary
DNS Server, type the IP address of the primary DNS server 8.8.8.8. In Secondary DNS Server,
type the IP address of the secondary DNS server 8.8.4.4. Click Apply button to save the changes.
Creating User & group:

Go to User & Device > User Definition. Create a local user account for a SSL VPN user.
Enter name and password for user -> Click Next to continue.

Enter email of user -> Click Next to continue
Choose Enabled and click Submit
Go to User & Device > User Groups. Create a user group for SSL VPN users and add the new
user account.

Configuring SSL VPN Tunnel:
Go to VPN > SSL-VPN Settings and set Listen on Interface(s) to WAN. To avoid port conflicts, set
Listen on Port to 4433. Set Restrict Access to Allow access from any host. In my case the
Fortinet_Factory certificate is used as the Server Certificate.
Under Tunnel Mode Client Settings, set IP Ranges to use the default IP range SSLVPN_TUNNEL-
ADDR1.

Under Authentication/Portal Mapping, add the SSL VPN user group and map it to the Web-
access portal. If necessary, map a portal for All Other Users/Groups.
Adding Address for Local Network:

Go to Policy & Objects > Addresses. Add the address for the local network. Set Type to
IP/Netmask, Subnet/IP Range to the local subnet, and Interface to an internal port.
Security Policy:
Go to Policy & Objects > IPv4 Policy. Add a security policy allowing access to the internal
network through the VPN tunnel interface. Set Incoming Interface to ssl.root and Outgoing
Interface to the local network interface. Select Source and set Address to all and Source User to
the SSL-VPN user group. Set Destination Address to the local network address, Service to ALL,
and enable NAT. Configure any remaining firewall and security options as desired.

Add a second security policy allowing SSL VPN access to the Internet. For this policy, Incoming
Interface is set to ssl.root, Outgoing Interface is set to WAN, and Destination is set to all.

Testing:
Using a supported Internet browser, connect to the SSL VPN web portal using the remote
gateway configured in the SSL VPN settings in my case 192.168.122.100:4433
After successfully login, the web portal appears.

Verification:
To connect to the Local Website, select Quick Connection. Select HTTP/HTTPS, then enter the
URL or IP Address and select Launch.
The local website will launch.
On the FortiGate, go to Monitor > SSL-VPN Monitor. The user is connected to the VPN.

You can also use the Quick Connection for other allowed types of traffic, such as Telnet.
An Telnet connection will open in your browser, connecting to the requested Host. Java is
required for an Telnet connection.

OK 78 Remote+Access+VPN1

Uploaded by

Copyright:

Available Formats

OK 78 Remote+Access+VPN1

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

OK 78 Remote+Access+VPN1

Uploaded by

Copyright:

Available Formats

Remote-Access VPNs:

IPSec VPN SSL VPN

1 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 056 430 3717

Remote Access VPN

2 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 056 430 3717

Login to FortiGate Firewall type https://192.168.140.100 in any browser.

3 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 056 430 3717

Configure Default Route:

4 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 056 430 3717

Creating User & group:

5 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 056 430 3717

Choose Enabled and click Submit

6 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 056 430 3717

7 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 056 430 3717

Adding Address for Local Network:

8 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 056 430 3717

9 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 056 430 3717

After successfully login, the web portal appears.

10 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 056 430 3717

The local website will launch.

11 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 056 430 3717

12 | P a g e Created by Ahmad Ali E-Mail: ahmadalimsc@gmail.com , Mobile: 056 430 3717

You might also like

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.