Troubleshooting Tip: SSL VPN is connected but is not getting the intended IP address from the configured address range

Sherman_P · ‎02-19-2024

Description

This article describes that the address range configured under ‘config authentication-rule’ will take precedence over what is configured under ‘config vpn ssl settings'.

Example:

config vpn ssl settings
set servercert "Fortinet_Factory"
set tunnel-ip-pools "CUSTOM_RANGE"
set source-interface "port1"
set source-address "all"
set source-address6 "all"
set default-portal "web-access"
config authentication-rule
edit 1
set groups "sslvpngroup"
set portal "full-access"
next
end
end

config vpn ssl web portal
edit "full-access"
set tunnel-mode enable
set ipv6-tunnel-mode enable
set web-mode enable
set ip-pools "SSLVPN_TUNNEL_ADDR1"
set ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"
config bookmark-group
edit "gui-bookmarks"
next
end
next
end

config firewall address
edit "CUSTOM_RANGE"
set uuid fd50ff24-cf96-51ee-c2a1-3cc66818b050
set type iprange
set start-ip 192.168.1.0
set end-ip 192.168.1.10
next
end

config firewall address
edit "SSLVPN_TUNNEL_ADDR1"
set uuid 0509ed58-bb00-51ee-43cf-7daf4fb4e3ed
set type iprange
set start-ip 10.212.134.200
set end-ip 10.212.134.210
next
end

In the above configuration, the user connects successfully and the obtained IP comes from the SSLVPN_TUNNEL_ADDR1 address group since it is the one configured under ‘config authentication-rule’.

Scope

FortiGate.

Solution

To get the correct IP, always check and verify what is the address range under ‘config authentication-rule’ and configure it as necessary.

Always check the 'tunnel-addr-assigned-method' parameter under the SSL VPN setting. This can only be checked via CLI.
The default is 'first-available'.

FGT (settings) # set tunnel-addr-assigned-method

first-available <----- Assign the first available address from the pools.
round-robin <----- Assign the available address from the pool in a round-robin fashion.

If 'round-robin' is configured, the SSL VPN connection will get its IP from the configured IP Pool under 'config vpn ssl settings' and bypass the IP Pool from the SSL VPN Portal.

config vpn ssl settings
set tunnel-addr-assigned-method round-robin
end