In larger environments, SSL VPN setups can grow to be complex, including different user groups with the different portals in the SSL VPN settings, and many different policies for SSL VPN.Īt this point, with multiple groups in use, the way FortiGate authenticates SSL VPN users can be a bit difficult to understand intuitively. An SSL VPN policy exists (a policy with the SSL VPN tunnel interface as source interface) this will require a user or group to be included in the source options A default portal is configured (under 'All other users/groups' in the SSL VPN settings) SSLVPN is set to listen on at least one interface This requires the following configuration: # config firewall address edit 'restriction_poland' set type geography set country 'PL' Addresses, select 'Create new', select the address Type as 'Geography' and select the country to allow.This article describes a basic understanding of how FortiGate SSL VPN authentication works how FortiGate determines what groups to check a user against, and common issues and misunderstandings about the process.įortiGate includes the option to set up an SSL VPN server to allow client machines to connect securely and access resources through the FortiGate. The End user is getting lots of failed VPN login attempts lately, so they created a policy to block traffic from an address group that contains some countries, then created a deny policy (please see cover image), but they are still seeing login attempts from these countries.Īny idea if the configuration is correct (incoming/outgoing interface)?īy default, SSL VPN’s are accessible to all public addresses on internet.ġ) Configure firewall address with the type geography.

Fortinet End user reports Geo-Blocking by country doesn't seem to be working.

Fortigate ssl vpn