Configure remote access: VPN Client-to-Site

Using a VPN allows you to organize secure remote access for employees via the internet to corporate services and data hosted in the Selectel infrastructure. Using the hardware-based FortiGate firewall in Selectel, you can configure remote access to private organization networks based on SSL, IPsec, and L2TP over IPsec technologies, using various software installed on remote users' computers, laptops, and mobile phones, such as:

FortiClient client from Fortinet;
client from Cisco;
using operating system tools.

To create a VPN tunnel on the firewall, the following must already be configured:

an external interface through which devices will connect;
an internal network;
access to the FortiGate web interface.

SSL-VPN modes

Tunnel mode — a mode in which the SSL VPN client encrypts all traffic from the remote client computer and sends it to the FortiGate via an SSL VPN tunnel over an HTTPS channel between the user and the FortiGate. Tunnel mode supports a variety of protocols and applications. For tunnel mode, connecting to the FortiGate requires a standalone SSL-VPN client, FortiClient. FortiClient adds a virtual network adapter to the user's computer, designated as fortissl. This virtual adapter dynamically receives an IP address from the FortiGate every time the FortiGate establishes a new VPN connection. Inside the tunnel, all traffic is encapsulated in SSL/TLS. The main advantage of tunnel mode over web mode is that after the VPN is established, any IP network application running on the client can send traffic through the tunnel. The main disadvantage is that tunnel mode requires the installation of a software VPN client, which requires administrator privileges;
Web mode — a mode that provides access to the network via a web browser with built-in SSL encryption. Users authenticate via the FortiGate SSL VPN web portal, which provides access to network services and resources, including HTTP/HTTPS, Telnet, FTP, SMB/CIFS, VNC, RDP, and SSH. The Bookmarks section on the SSL-VPN portal page contains links to all or some of the resources available to the user. The Quick Connection widget allows users to enter the URL or IP address of the server they want to connect to. A web-SSL-VPN user uses these two widgets to access the internal network. The main advantage of web mode is that it generally does not require the installation of additional software. This mode has the following limitations:
- all interaction with the internal network must be carried out exclusively using a browser (via the web portal). External network applications running on the user's computer cannot send data through the VPN;
- a secure HTTP/HTTPS gateway mechanism, which does not work for everything, but only for a few popular protocols, such as HTTP, FTP, and Windows shares.
Split mode — a tunneling mode included in tunnel mode that directs traffic only to the specified network via the FortiGate. When split tunneling is enabled, only traffic destined for the private network behind the remote FortiGate is routed through the tunnel. All other traffic is sent over the regular encrypted route;
Full mode — a tunneling mode where split tunneling is disabled; all IP traffic generated by the client computer, including internet traffic, is routed through the SSL-VPN tunnel to the FortiGate. This sets the FortiGate as the default gateway for the host. You can use this method to apply security features to traffic on these remote clients, as well as to monitor or restrict internet access. This increases latency and bandwidth usage.

Configure SSL VPN

Create user groups

Users will be granted remote access and will be able to utilize SSL VPN technology.

Go to User & Authentication → User Definition → Create New.
Create a local user, specify a username and password, and contact information if necessary.
Combine the created users into a group.
To create a user group, go to User & Authentication → User Groups → Create New.
Specify the group name, Firewall type, and the group members created earlier.

Create SSL VPN tunnel

Go to VPN → SSL-VPN Portal → Create New.
Specify a name and enable Tunnel Mode.
In the Source IP Pools field, specify an address pool ( **IP Range **) that will be assigned to remote users. You can add the default pool SSLVPN_TUNNEL_ADDR1, or your own configured similarly.

In the portal settings, you can also enable client checks, restrict certain OS versions, and set other client connection parameters.

Split mode

When creating a split tunnel, traffic is routed only to the designated network.

Enable Enable Split Tunneling.
Select Routing Address to define the destination network that will be routed through the tunnel, meaning remote clients will have access to these addresses.
Click + and select an address from the existing ones.
To create an address, click Create in the pop-up window or go to Policy & Objects → Addresses → Create New.

Full mode

If you need a full mode tunnel where all remote client traffic passes through the FortiGate, disable Enable Split Tunneling.

Web mode

Another setting is Enable Web Mode, which allows you to enable web mode. Here you can configure:

portal name (the Portal Message field);
design;
other settings.

Of greatest interest is the User Bookmarks field — this option allows users to create their own bookmarks. In the Predefined Bookmarks field, bookmarks can be created centrally for all users. For example, you can create a bookmark to connect to a remote desktop via RDP. This completes the configuration of the SSL Tunnel itself.

Configure general SSL VPN settings

Go to VPN → SSL-VPN Settings.
Specify the "listening" interface, i.e., the external interface that will receive connections from remote users (in this example — wan1), and the port they will connect through. When defining the port, it may overlap with others defined for administrative access. For example, 443 is specified by default, which may conflict with the HTTPS port.
In the Restrict Access parameter, set Allow access from any hosts, or if you need to restrict access, click Limit access to specific hosts and grant access to specific hosts.
Specify the inactivity period after which the user will be forcefully disconnected from the VPN by enabling Idle Logout and defining the value in Inactive For; the default is 300 seconds.
Select a certificate for Server Certificate. This certificate is used for authentication and encryption of SSL VPN traffic. By default, this is the built-in Fortinet_Factory. Working with the built-in certificate is possible, but users will see a warning that the certificate is invalid because there is no CA certificate in the certificate store that signed the current SSL certificate. It is recommended to purchase a certificate for your server and upload it for authentication.

Add a certificate for authentication

Go to System → Certificates.
Make sure that under System → Feature Visibility, Certificates is enabled.
Select Import → Local Certificate.
In the window that opens, set Type to Certificate.
Upload the Certificate file and Key file for your certificate and enter the password in the Password field.
The server certificate will appear in the Certificates list.
Install the CA certificate — this is the certificate that signs both the server certificate and the user certificate, for example, for SSL VPN user authentication. To do this, under System → Certificates, select Import → CA Certificate.
In the window that opens, set Type — File and upload the certificate file.
The CA certificate will appear in the External CA Certificates list.

Configure PKI users and a user group to use certificate-based authentication. To do so, use the CLI to create PKI users:

config user peer
    edit pki01
        set ca CA_Cert_Name
        set subject User_Name
    next
end

Ensure that the subject matches the certificate's username. When you create a PKI user, a new menu is added to the graphical interface where you can continue the configuration.
Go to User & Authentication → PKI to define a new user.
Click Edit to edit the user account and enable Two-factor authentication.
Make sure that this user is in the SSL VPN user group created earlier (see **Creating a user group **).

You can also check remote user certificates by enabling Require Client Certificate. In the Authentication/Portal Mapping section, you need to map the SSL portal to a user group. By default, all users have access to the same portals. This table allows you to map different portals to different user groups. Create a new entry in the table by clicking Create New and defining the portal and user group. After configuring, click Apply and proceed to creating the security policy.

Configure a policy

For users to successfully connect to our VPN and have the necessary access, you need to create a policy allowing access from the ssl.root interface to the local network interface.

Go to Policy & Objects → Firewall Policy → Create New.
Specify the policy name; the incoming interface must be SSL-VPN tunnel interface(ssl.root).
Select the outgoing interface, which in this case is the internal lan interface.
In the Source field, select the previously created user group, in this case SSLVPNGROUP, and the address object all.
In the Destination field, select the required local network.
Specify the required services and save the policy.

Configure FortiClient

The FortiNet FortiClient client can be downloaded for free from the official website. FortiClient is compatible with many platforms, on each of which free use of SSL VPN is available. You can also purchase a license for the client, which provides additional features and technical support. Features of use and compatibility can also be found on the official website in the Technical Specification section.

To configure the connection on the client:

Go to REMOTE ACCESS and select SSL-VPN.
Specify the connection name, FortiGate IP address, and port to which the client connects (configured in **Configuring General SSL VPN Settings **).
If necessary, select certificates and authentication parameters (either prompt for a username and password upon each connection or save the username).
Save this connection.
Try to connect by specifying the connection name, username, and password.

If web mode was previously enabled for the SSL portal, you can connect either using a browser or use the created bookmark without using FortiClient:

Enter the address of your FortiGate and the port where connection is available in the address bar (see **Configuring General SSL VPN Settings **).
Authorize by entering your username and password.

Configure IPSec VPN

Create user groups

To create a VPN tunnel via IPsec, you must create users who will be granted remote access and combine them into a group.

Go to User & Authentication → User Definition → Create New.
Create a local user, specify a username and password, and contact information if necessary.
Combine the created users into a group.
To create a user group, go to User & Authentication → User Groups → Create New.
Specify the group name, Firewall type, and the group members created earlier.

IPSec Wizard

To create the tunnel itself, you can use the special IPsec Wizard, which provides the necessary configuration templates:

Go to VPN → IPsec Wizard.
In the VPN Setup step, enter the tunnel name.
Select the tunnel type Remote Access and the remote device type Client-based and FortiClient, which indicates that the FortiClient client is used for connection.
Click Next.
In the Authentication step, specify the incoming interface that connections will arrive at (in this case, wan1).
Select the authentication type: Pre-shared key or certificate. In this case, a secret key is selected and its value is entered in the Pre-shared key parameter.
Specify the previously created user group that will be granted connection access.
In the Policy & Routing step, select the local interface from the drop-down menu that remote clients will connect to.
In the Local Address parameter, specify the subnet that users will have access to. In this case, the address object all is selected.
To select a specific subnet, click + and select an address from the existing ones.
To create an address, click Create in the pop-up window or go to Policy & Objects → Addresses → Create New.
In the Client Address Range field, specify the address pool that will be assigned to remote clients upon connection.
Make sure that these addresses do not overlap with internal addressing. Leave the default value in Subnet Mask.
The DNS Server field allows you to select the DNS server that remote users will use when connecting to the tunnel. In this case, System DNS is selected.
The Enable Split Tunnel parameter allows you to grant users access only to specific subnets rather than routing all their traffic through the FortiGate.
The Allow Endpoint Registration option allows you to receive various information about endpoints and make decisions based on this information (for example, whether to allow an endpoint to connect or not).
In the Client Options step, you can configure client options: saving passwords, auto-connect, and always-on connection.
After these actions are performed, the tunnel is created, and a summary of the objects created by the wizard appears on the screen.

Connect FortiClient

To configure the connection on the client:

Go to the REMOTE ACCESS section and select IPsec VPN.
Specify the connection name and the FortiGate IP address, and select the authentication method. In this case, Pre-shared key is selected and the secret key value is entered, as configured earlier.
In the Authentication field, select:
- the Prompt on login option so that FortiClient prompts for a username and password upon each connection;
- the Save login option so that only the password is prompted upon each connection. In this case, enter the username in the Username field.
Save this connection.

After this, select the name of the saved connection, enter the username created in step 1 and their password, and click Connect.

Configure L2TP over IPsec

Create user groups

To create a VPN tunnel via IPsec, you must create users who will be granted remote access and combine them into a group.

Go to User & Authentication → User Definition → Create New.
Create a local user, specify a username and password, and contact information if necessary.
Combine the created users into a group.
To create a user group, go to User & Authentication → User Groups → Create New.
Specify the group name, Firewall type, and the group members created earlier.

IPSec Wizard

To configure an L2TP over IPsec tunnel:

Go to VPN → IPsec Wizard to use the setup wizard.
Select template type Remote Access.
In Remote Device Type — Native and Windows Native.
In the Name field, enter the tunnel name.
Select the external interface through which remote users will connect as Incoming Interface. In this case, wan1.
For Authentication Method, select Pre-shared Key and enter the secret key value in the field below. You will need to enter this key on the client later when setting up the VPN connection.
In the User Group parameter, enter the created user group.
In the Policy & Routing step, specify the local interface from the drop-down menu that remote clients will connect to.
In the Local Address parameter, specify the subnet that users will have access to. In this case, the address object all is selected.
To select a specific subnet, click + and select an address from the existing ones.
To create an address, click Create in the pop-up window or go to Policy & Objects → Addresses → Create New.
In the Client Address Range field, specify the address pool that will be assigned to remote clients upon connection.
Ensure that these addresses do not overlap with your internal addressing.
Leave the default value in Subnet Mask.
Click Create.

After this, the tunnel will be created and a summary of the created objects will appear on the screen.

Configure connection in Windows

Go to Network and Sharing Center → Set up a new connection or network.
In the window that opens, select Connect to a workplace, then → Use my Internet connection (VPN).
In the Internet address field, enter the FortiGate IP address.
In the Destination name field, enter the name of the connection being created.
After this, the created connection will appear among the available networks.
In the Network and Sharing Center window, go to Change adapter settings.
Among the displayed networks, select the created VPN connection.
Right-click and select Properties.
In the Properties window that opens, go to the Security tab.
In Type of VPN, select Layer 2 Tunneling Protocol with IPsec (L2TP/IPsec).
Go to Advanced settings.
Select Use preshared for authentication.
In the Key field, enter the value of the secret key that you specified when configuring the tunnel on the FortiGate.
Click OK to connect.
Enter the username created earlier and its password.