Setting up Static Addresses for Fortigate SSL VPN clients

This is a post by cjcott01 from  travelingpacket.com that explians how to assign static addresses for Fortigate SSL VPN CLients

 

I needed to have a specific SSL VPN client to always have the same IP address. This is not overly simple as it seems it should be. I have read there are very neat ways to do it through FortiAuth, or Radius options – but Here I am just doing all Fortigate configuration.

I am using a local account on the firewall in this example, but it would work with an AD users without issues – you would just have to map the user directly and not use groups.

SO, in this example I have a Scan gun that needs to have a specific IP every time it connects. So an overview of the steps are:

• Setup SSL VPN (Should be already done if you are trying this).
• Have LDAP or Radius integration already setup if you are specifically using that.
• Setup Address object that you need the device to get – For this example 10.200.253.241.
• Create a user object either local, or LDAP/Radius. – In this example Bargun01.
• Create a specific portal if needed just for this user.
• Create group/portal matching in SSL Settings.
• Create firewall policy allowing that client in.

Ok, first lets create our address object .

Next lets create our user object – We need to do a specific user object, because we only want one device to be logged in and match this policy.

Then lets create the portal specific for this device – which only needs access to one server. In this portal we will match the it to the individual IP object we created, and set the remote access server it needs. Notice that the source IP Pool is the specific IP we set – this is where all the real magic is.

Next lets match up our user to the portal.

One more thing to do – and that’s to setup our firewall policy! Notice that the user matches what we put in the portal. Very specific. That’s it.