In this example: sslvpn certificate auth. Create new Authentication/Portal Mapping for group sslvpngroup mapping portal full-access.Under Authentication/Portal Mapping, set default Portal web-access for All OtherUsers/Groups.Set ServerCertificate to the authentication certificate.Choose proper Listen on Interface, in this example, wan1.

Disable Enable Split Tunneling so that all SSL VPN traffic goes through the FortiGate.This portal supports both web and tunnel mode. Go to VPN > SSL-VPN Portals to edit the full-access.Go to User& Device > User> UserGroups and create a group sslvpngroup.Enable Require two-factorauthentication and set a Password for the account.Edit the user account and expand Two-factorauthentication.Go to User& Device > PKI to see the new user. Now that you have created a PKI user, a new menu is added to the GUI. Use the CLI console to enter the following commands:Įnd l Ensure the subject matches the name of the user certificate. To use certificate authentication, PKI users must be created in the CLI. The CA certificate now appears in the list of External CA Certificates. Select Local PC and then select the certificate file.Go to System > Certificates and select Import > CA Certificate.In this example, it is used to authenticate SSL VPN users. The CA certificate is the certificate that signed both the server certificate and the user certificate. The server certificate now appears in the list of Certificates.

If desired, you can change the Certificate Name.

l Choose the Certificate file and the Key file for your certificate, and enter the Password.

Go to System > Certificates and select Import > Local Certificate.

Go to System > Feature Visibility and ensure Certificates is enabled. The server certificate is used for encrypting SSL VPN traffic and will be used for authentication.

Go to Firewall & Objects > Address and create an address for internet subnet 168.1.0.

Go to Network > Interface and edit the wan1.

Port1 interface connects to the internal network.

Configure the interface and firewall address.

The SSL VPN connection is established over the WAN interface. WAN interface is the interface connected to ISP. This topic provides a sample configuration of SSL VPN that requires users to authenticate using a certificate.

Fortigate ssl vpn mac