FortiOS 5.2 VPN: SSL VPN with certificate authentication(Form-based)

This recipe requires that you have three certificates:

• CA certificate
• server certificate (signed by the CA certificate)
• user certificate (signed by the CA certificate)

You will install the CA certificate and server certificate on the FortiGate. The user certificate will be installed on the remote user’s PC. The certificates in the example were created using OpenSSL.

1. Enabling certificate management

Go to System > Config > Features > Show More and make sure that Certificates is enabled.

If necessary, Apply your changes.

2. Installing the server certificate

The server certificate is used for encrypting SSL VPN traffic and will be used for authentication.

Go to System > Certificates and select Import > Local Certificate.

Set Type to Certificate, choose the Certificate file and the Key file for your certificate, and enter the Password. If desired, you can also change the Certificate Name.

The server certificate now appears in the list of Certificates.

3. Installing the CA certificate

The CA certificate is the certificate that signed both the server certificate and the user certificate. In this example, it is used to authenticate SSL VPN users.

Go to System > Certificates and select Import > CA Certificate.

Select Local PC, then select the certificate file.

The CA certificate now appears in the list of External CA Certificates (in the example, it is called CA_Cert_1).

4. Creating PKI users and a user group

In order to use certificate authentication, PKI users must be created in the CLI. Go to System > Dashboard > Status and enter the following commands into the CLI widget:

config user peer
  edit rdiaz
    set ca CA_Cert_1
    set subject User01
  end

Make sure that subject matches the name of the user certificate (in the example, User01) 

Now that you have created a PKI user, a new menu has been added to the GUI.* Go to User & Device > PKI to see the new user listed.

Edit the user account and expand Two-factor authentication. Enable Require two-factor authentication and set a Password for the account.

Go to User & Device > User > User Groups and create a group for SSL VPN users. Add the new user to the group.

5. Creating an SSL VPN portal

Go to VPN > SSL > Portals.

Edit the full-access portal. This portal supports both web and tunnel mode.

Enable Split Tunneling is not enabled so that all SSL VPN traffic will go through the FortiGate unit.

6. Configuring the SSL VPN tunnel

Go to VPN > SSL > Settings.

Under Connection Settings, set Listen on Interface(s) to wan1. To avoid conflicts, set Listen on Port to 10443. 

Set Server Certificate to the authentication certificate and enable Require Client Certificate.

Under Authentication/Portal Mapping, assign the user group to the full-access portal. If necessary, assign a portal for All Other Users/Groups.

7. Adding security policies for access to the Internet and internal network

Go to Policy & Objects > Policy > IPv4. Create a security policy allowing SSL VPN user to access the internal network.

Set Incoming Interface to ssl.root. Set Source Address to all and Source User to the new user group. Set Outgoing Interface to the local network interface so that the remote user can access the internal network.

Set Destination Address to all, enable NAT, and configure any remaining firewall and security options as desired.

Add a second security policy allowing SSL VPN users to access the Internet.

For this policy, Incoming Interface is set to ssl.root and Outgoing Interface is set to wan1.

Make sure that NAT is enabled.

8. Installing the user certificate

To use the user certificate, it must first be installed on the user’s PC. When the user attempts to authenticate, the user certificate will be checked against the CA certificate, to verify that they match.

Every user should have a unique user certificate, so that you can distinguish each user and so that it is possible to revoke a user’s certificate if they should no longer have VPN access.

The installation instructions differ depending on what application is being used to connect to the VPN.

Internet Explorer or Safari (on Windows or Mac OS):

If you are using the above applications to connect to the VPN, you must install the certificate into the certificate store for your OS. The certificate should be installed in the user’s local certificate store (and not on the machine’s local certificate store).

If you are using Windows 7/8/10, open the certificate file and select Install Certificate. The Import Wizard appears.

Import the certificate using the Import Wizard. Import the certificate into the Personal store.

If you are using Mac OS X, open the certificate file. Keychain Access opens.

Double-click the certificate. Expand Trust and select Always Trust. 

FortiClient (on Windows or Mac OS)

In order to connect to the VPN with FortiClient, you will first have to use the above instructions to install the certificate for your OS. Once the certificate has been installed, you can configure FortiClient to access the VPN.

Open FortiClient and go to Remote Access > Configure VPN. Create a new SSL VPN connection.

Set the Connection Name, Remote Gateway, and Customize port. Enable Client Certificate and select the authentication certificate. 

Firefox (on Windows or Mac OS)

Firefox has its own certificate store. If you will be using Firefox to connect to the VPN, then the user certificate must be installed in this store, rather than in the OS.

Depending on the version, go to Menu > Options or Preferences > Advanced and find the Certificates tab.

Select View Certificates, then select the Your Certificates list. Import the certificate file.

9. Results

Using a web browser

Browse to the SSL VPN portal (in the example, http://172.20.121.46:10443).

A message will appear requesting a certificate for authentication. Select the user certificate.

Enter your user credentials when requested.

You are able to connect to the SSL VPN web portal.

Using FortiClient

Open FortiClient and connect to the VPN. You are able to connect.

On the FortiGate, go to VPN > Monitor > SSL-VPN Monitor. You can see that the user is currently connected to the VPN.