6.1 SSL VPN Web Mode & Tunnel Mode Configuration

6.1 SSL VPN Web Mode & Tunnel Mode Configuration

Fortinet FortiOS 7.6 provides robust remote-access capabilities through Secure Sockets Layer Virtual Private Network (SSL VPN). SSL VPN enables secure connections for remote users over the internet using standard Transport Layer Security (TLS/SSL) encryption. FortiOS supports two operational modes for SSL VPN deployments: Web Mode and Tunnel Mode. Understanding the architectural differences, configuration workflows, routing behavior, and security enforcement mechanisms of each mode is essential for passing the Fortinet Certified Professional (FCP) FortiGate Administrator exam.

---

Web Mode vs. Tunnel Mode Architecture

FortiOS SSL VPN can be configured in Web Mode, Tunnel Mode, or a hybrid combination depending on the remote access requirements of the organization.

---

Deep Dive: Web Mode (Clientless Access)

In Web Mode, the FortiGate acts as an HTTP/HTTPS reverse proxy. Remote users authenticate through a web browser to access the FortiGate's SSL VPN portal page. When a user clicks a resource link (bookmark) inside the portal, FortiGate fetches the resource from the internal network on behalf of the client and rewrites the content to render it inside the user's browser session.

Portal Bookmarks & Supported Protocols

Web Mode supports several built-in application proxies (bookmarks):

• Web Applications: HTTP and HTTPS applications.
• Remote Desktop & Terminal: RDP (via HTML5/canvas rendering), VNC, SSH, and Telnet.
• File Transfer & Storage: SMB/CIFS file shares and SFTP.

Limitations of Web Mode

• Content Rewriting Overhead: Complex web applications using non-standard JavaScript, hardcoded IP addresses, or WebSocket connections may fail to render correctly due to HTML reverse proxy rewriting limitations.
• No Raw IP Connectivity: Applications that require direct client-to-server IP communication (such as custom client-server applications, VoIP softphones, or network administrative tools) cannot operate in Web Mode.

---

Deep Dive: Tunnel Mode (Full Layer 3 Connectivity)

In Tunnel Mode, the user installs FortiClient on their endpoint device. When FortiClient authenticates to FortiGate, FortiOS negotiates a TLS or DTLS (Datagram TLS) tunnel and assigns an IP address to the client's Fortinet Virtual Ethernet Adapter from a configured IP pool.

IP Allocation & DNS Configuration

When establishing a Tunnel Mode connection, FortiGate pushes several network settings to FortiClient:

• IP Address Allocation: Assigned from a defined firewall address range (set ip-pools).
• DNS Settings: FortiGate can push primary and secondary DNS servers (set dns-server1, set dns-server2) so that remote clients resolve internal domain names correctly.
• WINS Server Settings: Optional NetBIOS name resolution for legacy Windows environments.

Split Tunneling Modes

Tunnel Mode supports two split-tunneling configurations:

1. Split Tunneling Enabled (set split-tunneling enable):

   • FortiGate pushes explicit routes to the client operating system matching the destination subnets allowed in the SSL VPN portal.
   • Traffic destined for internal company subnets is encrypted and routed into the SSL VPN tunnel.
   • General internet traffic bypasses the SSL VPN tunnel and routes directly out the user's local internet connection (saving corporate WAN bandwidth).

2. Split Tunneling Disabled (set split-tunneling disable):

   • FortiGate overrides the default gateway on the remote client endpoint.
   • ALL traffic originating from the client—including public internet browsing—is encapsulated in the SSL VPN tunnel and sent to FortiGate.
   • FortiGate inspects public internet traffic using firewall security profiles (Web Filtering, IPS, Antivirus) before forwarding it out to the internet (Central Internet Breakout / Zero Trust stance).

---

Virtual ssl.root Interface & Firewall Policy Enforcement

Regardless of whether Web Mode or Tunnel Mode is used, FortiOS terminates all SSL VPN sessions on a system-created virtual interface named ssl.root.

+-----------------------+        SSL/TLS Tunnel        +------------------------+
| Remote User Endpoint  | ===========================> | FortiGate (`ssl.root`) |
| (Browser/FortiClient) |                              | Virtual Interface      |
+-----------------------+                              +------------------------+
                                                                    |
                                                          Firewall Policy Evaluation
                                                                    |
                                                                    v
                                                       +------------------------+
                                                       | Internal Destination   |
                                                       | (e.g. port1 / DMZ)     |
                                                       +------------------------+

Key Rules for ssl.root Firewall Policies

• Source Interface: Firewall policies allowing SSL VPN user access must ALWAYS specify ssl.root as the incoming (srcintf) interface.
• Destination Interface: The outgoing interface where target resources reside (e.g., port1, port2, or a VDOM interface).
• Source Address: Must contain the assigned SSL VPN IP pool range (e.g., SSLVPN_TUNNEL_ADDR1) for Tunnel Mode traffic, or all for Web Mode proxy traffic.
• User Authentication Enforcement: Firewall policies must specify the authorized user accounts or user groups in the set groups or set users fields.

Exam Tip: Traffic coming through an SSL VPN connection will be dropped by default if there is no active firewall policy explicitly matching srcintf ssl.root to the desired destination interface and user group.

---

CLI Configuration Workflow

Configuring SSL VPN in FortiOS 7.6 requires configuring settings under config vpn ssl settings, web portals under config vpn ssl web portal, and firewall policies.

Step 1: Configure SSL VPN Settings

config vpn ssl settings
    set servercert "Fortinet_Factory"
    set source-interface "port1"
    set source-address "all"
    set default-portal "full-access"
    set ip-pools "SSLVPN_TUNNEL_ADDR1"
    set dns-server1 10.0.1.10
    config authentication-rule
        edit 1
            set groups "VPN_Remote_Users"
            set portal "full-access"
        next
    end
end

Step 2: Configure SSL VPN Portal Properties

config vpn ssl web portal
    edit "full-access"
        set tunnel-mode enable
        set web-mode enable
        set ip-pools "SSLVPN_TUNNEL_ADDR1"
        set split-tunneling enable
        set split-tunneling-routing-address "Internal_Corporate_Subnet"
        config bookmark-group
            edit "gui-bookmarks"
                config bookmark
                    edit "Internal-RDP"
                        set apptype rdp
                        set host "10.0.1.50"
                        set port 3389
                    next
                    edit "Internal-Wiki"
                        set apptype https
                        set url "https://wiki.corp.local"
                    next
                end
            next
        end
    next
end

Step 3: Create Matching Firewall Policy

config firewall policy
    edit 45
        set name "SSL-VPN-Tunnel-Access"
        set srcintf "ssl.root"
        set dstintf "port1"
        set srcaddr "SSLVPN_TUNNEL_ADDR1"
        set dstaddr "Internal_Corporate_Subnet"
        set action accept
        set schedule "always"
        set service "ALL"
        set groups "VPN_Remote_Users"
        set nat disable
    next
end

---

Host Checking & Endpoint Compliance

FortiOS SSL VPN allows administrators to enforce client posture checks prior to granting tunnel or web access:

• OS Check: Rejects connection attempts from unsupported operating system versions.
• Host Check (AV/Firewall): Verifies that third-party antivirus software or desktop firewalls are active.
• FortiClient EMS Compliance: Checks if FortiClient is registered to a corporate FortiClient EMS server and compliant with enterprise security policies.