SSL VPN tunnel recommendations - FortiOS 3.0 MR4 or higher

‎02-05-2007

Article

Description

SSL VPN tunnel configuration recommendations

Components

Steps or Commands

For general configuration of SSL VPN Tunnels, Use the SSL VPN User Guide.

Place the SSL VPN firewall policies at the top (source IP can be all or must be the originating public IP address) of the policy list.
Add a deny policy below the SSL VPN policies to avoid overlap with the other firewall policies (the source is then the SSL VPN tunnel IP range).
If multiple SSL VPN groups with unique access permissions are configured, restrict tunnel ranges and use firewall addresses that match the specified tunnel ranges.

You can sniff the traffic as outlined in the Knowledge Base article Using the FortiOS built-in packet sniffer
You can check the sessions using the CLI commands:
diag sys session filter {dport | dst | policy | proto | sport | src}

diag sys session list

Related Articles