Technical Tip: SSL VPN behind NAT

FortiGate

FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.

Article Id 272076

Description

This article discusses SSL VPN in NAT mode.

Scope

FortiGate.

Solution

There will be a private IP on the WAN interface of FortiGate from the ISP.

It is possible to see the same IP on the SSL VPN setting when the WAN interface is chosen as the listening interface.

Login to the ISP router with the default gateway IP on the FortiGate WAN interface, then make the port forwarding rule for the SSL VPN port and point it to the FortiGate WAN interface IP.

Then on FortiClient use the public IP and port number of SSL VPN it will work just fine. If not sure where to get public IP, see the status under the dashboard of the FortiGate, and on system information, the WAN IP will be visible as public IP see the second screenshot.

Or get the WAN IP from the CLI command below:

diagnose sys waninfo

Public/WAN IP: ...

...

2541

Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.