SSL VPN with local user password policy

This is a sample configuration of SSL VPN for users with passwords that expire after two days. Users are warned after one day about the password expiring. The password policy can be applied to any local user password. The password policy cannot be applied to a user group or a local remote user such as LDAP/RADIUS/TACACS+.

In FortiOS 6.2, users are warned after one day about the password expiring and have one day to renew it. If the password expires, the user cannot renew the password and must contact the administrator for assistance.

In FortiOS 6.0/5.6, users are warned after one day about the password expiring and have to renew it. If the password expires, the user can still renew the password.

Sample topology

Sample configuration

WAN interface is the interface connected to ISP. This example shows static mode. You can also use DHCP or PPPoE mode. The SSL VPN connection is established over the WAN interface.

To configure SSL VPN using the GUI:

1. Configure the interface and firewall address. The port1 interface connects to the internal network.
   1. Go to Network > Interfaces and edit the wan1 interface.
   2. Set IP/Network Mask to 172.20.120.123/255.255.255.0.
   3. Edit port1 interface and set IP/Network Mask to 192.168.1.99/255.255.255.0.
   4. Click OK.
   5. Go to Firewall & Objects > Address and create an address for internet subnet 192.168.1.0.
2. Configure user and user group.
   1. Go to User & Device > User Definition to create a local user.
   2. Go to User & Device > User Groups to create a user group and add that local user to it.
3. Configure and assign the password policy using the CLI.
   1. Configure a password policy that includes an expiry date and warning time. The default start time for the password is the time the user was created.

      config user password-policy
        edit "pwpolicy1"
          set expire-days 2
          set warn-days 1
        next
      end

   2. Assign the password policy to the user you just created.

      config user local
        edit "sslvpnuser1"
          set type password
          set passwd-policy "pwpolicy1"
        next
      end

4. Configure SSL VPN web portal.
   1. Go to VPN > SSL-VPN Portals to edit the full-access portal.

      This portal supports both web and tunnel mode.

   2. Disable Enable Split Tunneling so that all SSL VPN traffic goes through the FortiGate.
5. Configure SSL VPN settings.
   1. Go to VPN > SSL-VPN Settings.
   2. Select the Listen on Interface(s), in this example, wan1.
   3. Set Listen on Port to 10443.
   4. Set Server Certificate to the authentication certificate.
   5. Under Authentication/Portal Mapping, set default Portal web-access for All Other Users/Groups.
   6. Create new Authentication/Portal Mapping for group sslvpngroup mapping portal full-access.
6. Configure SSL VPN firewall policy.
   1. Go to Policy & Objects > IPv4 Policy.
   2. Fill in the firewall policy name. In this example, sslvpn certificate auth.
   3. Incoming interface must be SSL-VPN tunnel interface(ssl.root).
   4. Set the Source Address to all and Source User to sslvpngroup.
   5. Set the Outgoing Interface to the local network interface so that the remote user can access the internal network. In this example, port1.
   6. Set Destination Address to the internal protected subnet 192.168.1.0.
   7. Set Schedule to always, Service to ALL, and Action to Accept.
   8. Enable NAT.
   9. Configure any remaining firewall and security options as desired.
   10. Click OK.

To configure SSL VPN using the CLI:

1. Configure the interface and firewall address.

   config system interface 
       edit "wan1"
           set vdom "root"
           set ip 172.20.120.123 255.255.255.0
       next
   end

2. Configure internal interface and protected subnet, then connect the port1 interface to the internal network.

   config system interface
       edit "port1"
           set vdom "root"
           set ip 192.168.1.99 255.255.255.0
       next
   end
   config firewall address
       edit "192.168.1.0"
           set subnet 192.168.1.0 255.255.255.0
       next
   end

3. Configure user and user group.

   config user local
       edit "sslvpnuser1" 
           set type password
           set passwd your-password
       next 
   end
   config user group
       edit "sslvpngroup" 
           set member "vpnuser1"
       next 
   end

4. Configure and assign the password policy.
   1. Configure a password policy that includes an expiry date and warning time. The default start time for the password is the time the user was created.

      config user password-policy
        edit "pwpolicy1"
          set expire-days 2
          set warn-days 1
        next
      end

   2. Assign the password policy to the user you just created.

      config user local
        edit "sslvpnuser1"
          set type password
          set passwd-policy "pwpolicy1"
        next
      end

5. Configure SSL VPN web portal.

   config vpn ssl web portal
       edit "full-access"
           set tunnel-mode enable
           set web-mode enable
           set ip-pools "SSLVPN_TUNNEL_ADDR1"
           set split-tunneling disable
        next
   end

6. Configure SSL VPN settings.

   config vpn ssl settings
       set servercert "server_certificate"
       set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"
       set source-interface "wan1"
       set source-address "all"
       set default-portal "web-access"
       config authentication-rule
           edit 1
               set groups "sslvpngroup"
               set portal "full-access"
           next        
   end

7. Configure one SSL VPN firewall policy to allow remote user to access the internal network.

   config firewall policy 
       edit 1
           set name "sslvpn web mode access"
           set srcintf "ssl.root"
           set dstintf "port1"
           set srcaddr "all"
           set dstaddr "192.168.1.0"
           set groups “sslvpngroup”
           set action accept
           set schedule "always"
           set service "ALL"
           set nat enable
       next
   end

To see the results of web portal:

1. From a remote device, use a web browser to log into the SSL VPN web portal http://172.20.120.123:10443.
2. Log in using the sslvpnuser1 credentials.

   When the warning time is reached, the user is prompted to enter a new password.

   In FortiOS 6.2, when the password expires, the user cannot renew the password and must contact the administrator.

   In FortiOS 6.0/5.6, when the password expires, the user can still renew the password.

3. On the FortiGate, go to Monitor > SSL-VPN Monitor to confirm the user connection.

To see the results of tunnel connection:

1. Download FortiClient from www.forticlient.com.
2. Open the FortiClient Console and go to Remote Access > Configure VPN.
3. Add a new connection.
   • Set the connection name.
   • Set Remote Gateway to the IP of the listening FortiGate interface, in this example, 172.20.120.123.
4. Select Customize Port and set it to 10443.
5. Save your settings.
6. Log in using the sslvpnuser1 credentials.

   When the warning time is reached, the user is prompted to enter a new password.

To check the SSL VPN connection using the GUI:

1. Go to VPN > Monitor > SSL-VPN Monitor to verify the user’s connection.
2. Go to Log & Report > Forward Traffic to view the details of the SSL VPN traffic.

To check that login failed due to password expired on GUI:

1. Go to Log & Report > VPN Events to see the SSL VPN alert labeled ssl-login-fail.
2. Click Details to see the log details about the Reason sslvpn_login_password_expired.

To check the web portal login using the CLI:

get vpn ssl monitor
SSL VPN Login Users:
 Index   User         Auth Type   Timeout    From           HTTP in/out   HTTPS in/out
 0       sslvpnuser1  1(1)        229        10.1.100.254   0/0           0/0

SSL VPN sessions:
 Index   User    Source IP      Duration        I/O Bytes       Tunnel/Dest IP 

To check the tunnel login using the CLI:

get vpn ssl monitor
SSL VPN Login Users:
 Index   User          Auth Type   Timeout    From           HTTP in/out   HTTPS in/out
 0       sslvpnuser1   1(1)        291        10.1.100.254   0/0           0/0

SSL VPN sessions:
 Index   User          Source IP      Duration   I/O Bytes      Tunnel/Dest IP 
 0       sslvpnuser1   10.1.100.254   9          22099/43228    10.212.134.200

To check the FortiOS 6.2 login password expired event log:

FG201E4Q17901354 # execute log  filter category event

FG201E4Q17901354 # execute log  filter field subtype vpn

FG201E4Q17901354 # execute log  filter field action ssl-login-fail

FG201E4Q17901354 # execute log  display 
1: date=2019-02-15 time=10:57:56 logid="0101039426" type="event" subtype="vpn" level="alert" vd="root" eventtime=1550257076 logdesc="SSL VPN login fail" action="ssl-login-fail" tunneltype="ssl-web" tunnelid=0 remip=10.1.100.254 user="u1" group="g1" dst_host="N/A" reason="sslvpn_login_password_expired" msg="SSL user failed to logged in"