FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
mbanica
Staff
Staff
Article Id 191314
Description
The design in configuring SSL VPN changed in 5.2 from 5.0. Previously in 5.0 the policies for web-mode and tunnel-mode were separately defined.

In 5.2 there is only one policy needed, which is from ssl.root to internal port.

Scope
All FortiGates.

Solution
In order to make the SSL VPN web-mode accessible it is necessary to have the user group defined in this policy, otherwise the access to SSL VPN page will not work.

Non working configuration
# config firewall policy
    edit 1
        set srcintf "ssl.root"
        set dstintf "internal"
        set srcaddr "SSLVPN_TUNNEL_ADDR1"
        set dstaddr "lan"
        set action accept
        set schedule "always"
        set service "ALL"
Working configuration
# config firewall policy
    edit 1
        set srcintf "ssl.root"
        set dstintf "internal"
        set srcaddr "SSLVPN_TUNNEL_ADDR1"
        set dstaddr "lan"
        set action accept
        set schedule "always"
        set service "ALL"
        set groups "SSL_VPN_users"

Contributors