FortiGate SSL VPN Web Mode: Configuration Guide

FortiGate SSL VPN gives remote users secure access without a full tunnel client: in web mode, users log into a portal in their browser and reach internal applications through bookmarks - for example an RDP session to a Windows server - while in tunnel mode the FortiGate pushes a full virtual adapter and routes all traffic. Web mode is the quickest to deploy and the least invasive on endpoints. This guide follows the official Fortinet cookbook workflow: interface and addresses, local users and groups, the web portal, the SSL-VPN settings on the WAN interface, and the firewall policy that ties it together, with the matching CLI snippet.

Step 1: Interfaces and Addresses

Give the WAN interface its public IP and the internal interface its LAN IP (172.20.120.123/24 WAN, 192.168.1.99/24 LAN in Fortinet's example), then create an address object for the protected internal subnet 192.168.1.0/24.

Step 2: Local User and Group

Under User and Device, create a local user sslvpnuser1 with a password, then a user group sslvpngroup containing that user.

Step 3: SSL VPN Web Portal

Under VPN > SSL-VPN Portals, create a web-mode-only portal and add a predefined bookmark that launches an RDP session to the Windows server:

config vpn ssl web portal
    edit "my-web-portal"
        set web-mode enable
        config bookmark-group
            edit "bookmarks"
                config bookmark
                    edit "RDP-WINSRV"
                        set type rdp
                        set hostname 192.168.1.100
                    next
                end
            next
        end
    next
end

Step 4: SSL-VPN Settings on the WAN Interface

Under VPN > SSL-VPN Settings, listen on the wan1 interface, set the port (10443 in the example), pick the server certificate, and map the group to the web portal:

config vpn ssl settings
    set servercert "Fortinet_Factory"
    set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"
    set source-interface "wan1"
    set source-address "all"
    set default-portal "web-access"
    config authentication-rule
        edit 1
            set groups "sslvpngroup"
            set portal "my-web-portal"
        next
    end
end

Step 5: Firewall Policy for SSL-VPN Traffic

Create an IPv4 policy whose incoming interface is the SSL-VPN tunnel interface (ssl.root), outgoing interface is the internal port1, source is the sslvpngroup, destination is the protected subnet 192.168.1.0/24, service ALL, action ACCEPT.

Verifying the SSL-VPN Service

Log into https://<wan-ip>:10443 in a browser with the local user's credentials, launch the RDP bookmark, then confirm sessions under VPN > Monitor > SSL-VPN Monitor and inspect forward traffic logs for the SSL-VPN entries.

Related articles: FortiGate IPsec site-to-site VPN and Juniper SRX route-based IPsec VPN.

原文链接：https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/579694/ssl-vpn-web-mode-for-remote-user