The SSL VPN web portal
This chapter explains how to use and configure the web portal features. This chapter is written for end users as well as administrators.
The following topics are included:
Connecting to the FortiGate unit
Web portal overview
Portal configuration
Using the Bookmarks widget
Using the Quick Connection Tool
Using the SSL VPN virtual desktop
Using FortiClient
Connecting to the FortiGate unit
You can connect to the FortiGate unit using a web browser. The URL of the FortiGate interface may vary from one installation to the next. If required, ask your FortiGate administrator for the URL of the FortiGate unit, and obtain a user name and password. You can connect to the web portal using an Android phone, iPhone, or iPad. The FortiGate unit will display the content of the portal to fit the device’s screen.
In addition, if you will be using a personal or group security (X.509) certificate to connect to the FortiGate unit, your web browser may prompt you for the name of the certificate. Your FortiGate administrator can tell you which certificate to select.
To log into the secure FortiGate HTTP gateway
- Using the web browser on your computer, browse to the URL of the FortiGate unit (for example, https://<FortiGate_IP_address>:443/remote/login). The FortiGate unit may offer you a self-signed security certificate. If you are prompted to proceed, select Yes.
A second message may be displayed to inform you that the FortiGate certificate distinguished name differs from the original request. This message is displayed because the FortiGate unit is attempting to redirect your web browser connection. You can ignore the message.
- When you are prompted for your user name and password:
- In the Name field, type your user name.
- In the Password field, type your password.
- Select Login.
The FortiGate unit will redirect your web browser to the FortiGate SSL VPN web portal home page automatically.
Web portal overview
After logging in to the web portal, the remote user is presented with a web portal page similar to the following:
Portal
Various widgets provide the web portal’s features:
- Session Information displays the elapsed time since login and the volume of HTTP and HTTPS traffic, both inbound and outbound.
- Quick Connection enables you to connect to network resources without using or creating a bookmark. l Download Forticlient provides access to the FortiClient tunnel application for various operating systems.
- Bookmarks provides links to network resources. You can use the administrator-defined bookmarks and you can
add your own bookmarks.
While using the web portal, you can select the Help button to get information to assist you in using the portal features. This information displays in a separate browser window.
When you have finished using the web portal, select the Logout button in the top right corner of the portal window.
Portal configuration
The SSL VPN web portal enables users to access network resources through a secure channel using a web browser. Fortinet administrators can configure log in privileges for system users and which network resources are available to the users.
Portal configuration
The portal configuration determines what the user sees when they log in to the portal. Both the system administrator and the user have the ability to customize the SSL VPN portal.
There are three pre-defined default web portal configurations available:
- full-access: Includes all widgets available to the user – Session Information, Tunnel Mode options, Connection Launcher, Remote Desktop, and Predefined Bookmarks. l tunnel-access: Includes Session Information and Tunnel Mode
- web-access: Includes Session Information and Predefined Bookmarks
You can also create your own web portal to meet your corporate requirements.
| Portal page | |
| Create New | Creates a new web portal. |
| Edit | Select a portal from the list to enable the Edit option, and modify the portal configuration. |
| Delete | Removes a portal configuration.
To remove multiple portals from the list, select the check box beside the portal names, then select Delete. |
| Name | The name of the web portal. |
| Ref. | Displays the number of times the object is referenced in other configurations on the FortiGate unit, such as security policies.
To view the location of the referenced object, select the number in Ref. column. To view more information about how the object is used, select one of: View the list page for these objects – automatically redirects you to the list page where the object is referenced at. Edit this object – modifies settings within that particular setting that the object is referenced with. View the details for this object – similar to the log viewer table, contains information about what settings are configured within that particular setting that the object is referenced with. |
Portal settings
A web portal defines SSL VPN user access to network resources. The portal configuration determines what SSL VPN users see when they log in to the unit. Both the Fortinet administrator and the SSL VPN user have the ability to customize the web portal settings. Portal settings are configured in VPN > SSL-VPN Portals.
The following settings are available, allow you to configure general and security console options for your web portal.
Portal
| Portal Setting | Description |
| Name | The name for the portal. |
| Limit Users to One SSL-VPN Connection at a Time | You can set the SSL VPN tunnel such that each user can only log into the tunnel one time concurrently per user per login. That is, once logged into the portal, they cannot go to another system and log in with the same credentials again. This option is disabled by default. |
| Tunnel Mode | These settings determine how tunnel mode clients are assigned IPv4 addresses. |
| Enable Split Tunneling | Select so that the VPN carries only the traffic for the networks behind the FortiGate unit. The user’s other traffic follows its normal route.
If you enable split tunneling, you are required to set the Routing Address, which is the address that your corporate network is using. Traffic intended for the Routing Address will not be split from the tunnel. |
| Source IP Pools | Select an IP Pool for users to acquire an IP address when connecting to the portal. There is always a default pool available if you do not create your own. |
| Tunnel Mode Client Options | These options affect how the FortiClient application behaves when connected to the FortiGate VPN tunnel. When enabled, a check box for the corresponding option appears on the VPN login screen in FortiClient, and is not enabled by default.
l Allow client to save password – When enabled, if the user selects this option, their password is stored on the user’s computer and will automatically populate each time they connect to the VPN. l Allow client to connect automatically – When enabled, if the user selects this option, when the FortiClient application is launched, for example after a reboot or system startup, FortiClient will automatically attempt to connect to the VPN tunnel. l Allow client to keep connections alive – When enabled, if the user selects this option, the FortiClient should try to reconnect once it detects the VPN connection is down unexpectedly (not manually disconnected by user). |
| Enable Web Mode | Select to enable web mode access. |
| Portal Message | This is a text header that appears on the top of the web portal. |
Portal configuration
| Portal Setting | Description |
| Theme | Select a color styling specifically for the web portal. |
| Show Session Information | The Show Session Information widget displays the login name of the user, the amount of time the user has been logged in and the inbound and outbound traffic statistics. |
| Show Connection Launcher | Displays the Connection Launcher widget in the web portal. |
| Show Login History | Select to include user login history on the web portal. |
| User Bookmarks | Enable to allow users to add their own bookmarks in the web portal. |
| Predefined Bookmarks | Select to include bookmarks on the web portal. Bookmarks are used as links to internal network resources. When a bookmark is selected from a bookmark list, a pop-up window appears with the web page. Telnet, VNC, and RDP require a browser plugin. FTP and Samba replace the bookmarks page with an HTML filebrowser. |
Predefined Bookmarks
Bookmarks are used as links to specific resources on the network. When a bookmark is selected from a bookmark list, a pop-up window appears with the requested web page. Telnet, RDP, and VNC pop up a window that requires a browser plug-in. FTP and Samba replace the bookmarks page with an HTML file-browser.
Note that the RDP/VNC web portals are not supported for the following platforms:
| Platform | Model |
| FortiGate | 80D, 92D, 200D, 200D-POE, 240D, 240D-POE, 600C, 800C, 1000C,
3240C, 3600C, and 5001C |
| FortiGate-Rugged | 90D |
| FortiWiFi | 92D |
A web bookmark can include login credentials to automatically log the SSL VPN user into the web site. When the administrator configures bookmarks, the web site credentials must be the same as the user’s SSL VPN credentials. Users configuring their own bookmarks can specify alternative credentials for the web site.
Applications available in the web portal
Depending on the web portal configuration and user group settings, one or more of the following server applications are available to you through Predefined Bookmarks, as well as the Quick Connection widget:
- Citrix makes use of SOCKS so that the Citrix client can connect to the SSL VPN port forward module to provide the connection.
- FTP (File Transfer Protocol) enables you to transfer files between your computer and a remote host.
Using the Bookmarks widget
- HTTP/HTTPS accesses web pages.
- Port Forward provides the middle ground between web mode and tunnel mode. When the SSL VPN receives data from a client application, the data is encrypted and sent to the FortiGate unit, which then forwards the traffic to the application server. l RDP (Remote Desktop Protocol), similar to VNC, enables you to remotely control a computer running Microsoft Terminal Services.
- SMB/CIFS implements the Server Message Block (SMB) protocol to support file sharing between your computer and a remote server host.
- SSH (Secure Shell) enables you to exchange data between two computers using a secure channel.
- TELNET (Teletype Network emulation) enables you to use your computer as a virtual text-only terminal to log in to a remote host.
- VNC (Virtual Network Computing) enables you to remotely control another computer, for example, accessing your work computer from your home computer.
Some server applications may prompt you for a user name and password. You must have a user account created by the server administrator so that you can log in.
Group-based SSL VPN bookmarks
The administrator can add bookmarks for groups of users. SSL VPN will only output the matched group-name entry to the client. This can only be done via the CLI.
To add group-based SSL VPN bookmarks – CLI:
config vpn ssl web portal edit “portal-name” set user-group-bookmark enable*/disable
next
end
config vpn ssl web user-group-bookmark edit “group-name” config bookmark edit “bookmark1” ….
next
end
next
end
Using the Bookmarks widget
The Bookmarks widget shows both administrator-configured and user-configured bookmarks. Administrator bookmarks cannot be altered but you can add, edit or delete user bookmarks.
Bookmarks widget
The FortiGate unit forwards client requests to servers on the Internet or internal network. To use the web-portal applications, you add the URL, IP address, or name of the server application to the My Bookmarks list. For more information, see Adding bookmarks on page 48.
If you want to access a web server or telnet server without first adding a bookmark to the My Bookmarks list, use the Connection Tool instead. For more information, see Using the Bookmarks widget on page 47.
Adding bookmarks
You can add frequently used connections as bookmarks. Afterward, select any hyperlink from the Bookmarks list to initiate a session.
To add a bookmark
- In the web portal, select New Bookmark.
- Enter the following information:
| Name | Enter the name to display in the Bookmarks list. |
| Type | Select the abbreviated name of the server application or network service from the drop-down list. |
| Location | Enter the IP address or FQDN of the server application or network service.
For RDP connections, you can append some parameters to control screen size and keyboard layout. See Using the Bookmarks widget on page 47. |
| Description | Optionally enter a short description. The description displays when you pause the mouse pointer over the hyperlink. |
| SSO | Single Sign On (SSO) is available for HTTP/HTTPS bookmarks only.
Disabled — This is not an SSO bookmark. Automatic — Use your SSL VPN credentials or an alternate set. See the SSO Credentials field. Static — Supply credentials and other required information (such as an account number) to a web site that uses an HTML form for authentication. You provide a list of the form field names and the values to enter into them. This method does not work for sites that use HTTP authentication, in which the browser opens a pop-up dialog box requesting credentials. |
| SSO fields | |
| SSO Credentials | SSL VPN Login — Use your SSL VPN login credentials.
Alternative — Enter Username and Password below. |
| Username | Alternative username. Available if SSO Credentials is Alternative. |
48
Using the Bookmarks widget
| Password | Alternative password. Available if SSO Credentials is Alternative. |
| Static SSO fields | These fields are available if SSO is Static. |
| Field Name | Enter the field name, as it appears in the HTML form. |
| Value | Enter the field value.
To use the values from SSO Credentials, enter %passwd% for password or %username% for username. |
| Add | Add another Field Name / Value pair. |
- Select OK and then select Done.
Group-based SSL VPN bookmarks
This CLI-only feature allows administrators to add bookmarks for groups of users. SSL VPN will only output the matched group-name entry to the client.
Syntax:
config vpn ssl web portal edit “portal-name” set user-group-bookmark enable*/disable
next
end
conf vpn ssl web user-group-bookmark edit “group-name” conf bookmark edit “bookmark1” ….
next
end
next
end
Group-based SSL VPN bookmarks
This CLI-only feature allows administrators to add bookmarks for groups of users. SSL VPN will only output the matched group-name entry to the client.
Syntax:
config vpn ssl web portal edit <portal-name> set user-group-bookmark [enable | disable]
next
end
config vpn ssl web user-group-bookmark edit <group-name> config bookmark edit <bookmark1> …. next
Quick Connection Tool
end
next
end
Using the Quick Connection Tool
The Quick Connection Tool widget enables a user to connect to a resource when it isn’t a predefined bookmark.
You can connect to any type of server without adding a bookmark to the Bookmarks list. The fields in the Quick Connection Tool enable you to specify the type of server and the URL or IP address of the host computer.
See the following procedures:
l To connect to a web server on page 50 l To ping a host or server behind the FortiGate unit on page 50 l To start a Telnet session on page 51 l To start an FTP session on page 51 l To start an SMB/CIFS session on page 51 l To start an SSH session on page 52 l To start an RDP session on page 52 l To start a VNC session on page 52
Except for ping, these services require that you have an account on the server to which you connect.
When you use the Connection Tool, the FortiGate unit may offer you its self-signed security certificate. Select Yes to proceed. A second message may be displayed to inform you of a host name mismatch. This message is displayed because the FortiGate unit is attempting to redirect your web browser connection. Select Yes to proceed.
To connect to a web server
- In Type, select HTTP/HTTPS.
- In the Host field, type the URL of the web server.
For example: http://www.mywebexample.com or https://172.20.120.101
- Select Go.
- To end the session, close the browser window.
To ping a host or server behind the FortiGate unit
- In Type, select Ping.
- In the Host field, enter the IP address of the host or server that you want to reach. For example: 11.101.22
- Select Go.
A message stating whether the IP address can be reached or not is displayed.
50
Using the Quick Connection Tool
To start a Telnet session
- In Type, select Telnet.
- In the Host field, type the IP address of the telnet host. For example: 11.101.12
- Select Go.
A Telnet window opens.
- Select Connect.
- A telnet session starts and you are prompted to log in to the remote host.
After you log in, you may enter any series of valid telnet commands at the system prompt.
- To end the session, select Disconnect (or type exit) and then close the TELNET connection window.
To start an FTP session
- In Type, select FTP.
- In the Host field, type the IP address of the FTP server. For example: 11.101.12
- Select Go.
A login window opens.
- Enter your user name and password and then select Login. You must have a user account on the remote host to log in.
- Manipulate the files in any of the following ways:
- To download a file, select the file link in the Name
- To access a subdirectory (Type is Folder), select the link in the Name
- To create a subdirectory in the current directory, select New directory. l To delete a file or subdirectory from the current directory, select its Delete
- To rename a file in the current directory, select its Rename l To upload a file to the current directory from your client computer, select Upload. l When the current directory is a subdirectory, you can select Up to access the parent directory.
- To end the FTP session, select Logout.
To start an SMB/CIFS session
- In Type, select SMB/CIFS.
- In the Host field, type the IP address of the SMB or CIFS server. For example: 11.101.12
- Select Go.
- Enter your user name and password and then select Login. You must have a user account on the remote host to log in.
- Manipulate the files in any of the following ways:
- To download a file, select the file link in the Name l To access a subdirectory (Type is Folder), select the file link in the Name column.
- To create a subdirectory in the current directory, select New Directory. l To delete a file or subdirectory from the current directory, select its Delete l To rename a file, select its Rename icon.
Quick Connection Tool
- To upload a file from your client computer to the current directory, select Upload.
- When the current directory is a subdirectory, you can select Up to access the parent directory.
- To end the SMB/CIFS session, select Logout and then close the SMB/CIFS window.
To start an SSH session
- In Type, select SSH.
- In the Host field, type the IP address of the SSH host. For example: 11.101.12
- Select Go.
- login window opens.
- Select Connect.
- SSH session starts and you are prompted to log in to the remote host. You must have a user account to log in. After you log in, you may enter any series of valid commands at the system prompt.
- To end the session, select Disconnect (or type exit) and then close the SSH connection window.
To start an RDP session
- In Type, select RDP.
- In the Host field, type the IP address of the RDP host. For example: 11.101.12
- Optionally, you can specify additional options for RDP by adding them to the Host field following the host address. See Using the Quick Connection Tool on page 50 for information about the available options. For example, to use a French language keyboard layout you would add the -m parameter:
10.11.101.12 -m fr
- Select Go.
A login window opens.
- When you see a screen configuration dialog, click OK.
The screen configuration dialog does not appear if you specified the screen resolution with the host address.
- When you are prompted to log in to the remote host, type your user name and password. You must have a user account on the remote host to log in.
- Select Login.
If you need to send Ctrl-Alt-Delete in your session, use Ctrl-Alt-End.
- To end the RDP session, Log out of Windows or select Cancel from the Logon window.
To start a VNC session
- In Type, select VNC.
- In the Host field, type the IP address of the VNC host. For example: 11.101.12
- Select Go.
A login window opens.
- Type your user name and password when prompted to log in to the remote host. You must have a user account on the remote host to log in.
- Select OK.
If you need to send Ctrl-Alt-Delete in your session, press F8, then select Send Ctrl-Alt-Delete from the pop-up menu.
- To end the VNC session, close the VNC window.
Using the SSL VPN virtual desktop
Note that the RDP/VNC web portals are not supported for the following platforms:
| Platform | Model |
| FortiGate | 80D, 92D, 200D, 200D-POE, 240D, 240D-POE, 600C, 800C, 1000C,
3240C, 3600C, and 5001C |
| FortiGate-Rugged | 90D |
| FortiWiFi | 92D |
Using the SSL VPN virtual desktop
The virtual desktop feature is available for Windows only. When you start an SSL VPN session, the virtual desktop replaces your normal desktop. When the virtual desktop exits, your regular desktop is restored. Virtual desktop information is encrypted so that no information from it remains available after your session ends.
To use the SSL VPN virtual desktop, simply log in to an SSL VPN that requires the use of the virtual desktop. Wait for the virtual desktop to initialize and replace your desktop with the SSL VPN desktop, which has a Fortinet SSL VPN logo as wallpaper. Your web browser will open to the web portal page.
You can use the virtual desktop just as you use your regular desktop, subject to the limitations that virtual desktop application control imposes. If it is enabled in the web portal virtual desktop settings, you can switch between the virtual desktop and your regular desktop. Right-click the SSL VPN Virtual Desktop icon in the taskbar and select Switch Desktop.
To see the web portal virtual desktop settings, right-click the SSL VPN Virtual Desktop icon in the taskbar and select Virtual Desktop Option.
When you have finished working with the virtual desktop, right-click the SSL VPN Virtual Desktop icon in the taskbar and select Exit. Select Yes to confirm. The virtual desktop closes and your regular desktop is restored.
Using FortiClient
Remote users can use FortiClient Endpoint Security to initiate an SSL VPN tunnel to connect to the internal network. FortiClient uses local port TCP 1024 to initiate an SSL encrypted connection to the FortiGate unit, on port TCP 10443. When connecting using FortiClient, the FortiGate unit authenticates the FortiClient SSL VPN request based on the user group options. the FortiGate unit establishes a tunnel with the client and assigns a virtual IP address to the client PC. Once the tunnel has been established, the user can access the network behind the FortiGate unit.
For information on configuring the FortiGate unit for SSL VPN connectivity, see Basic configuration on page 17.
For details on configuring FortiClient for SSL VPN connections, see the FortiClient documentation.