Tunnel-mode SSL-VPN policies usually start from…

Correct: b. FortiOS ssl.root interface.

Fortinet · FortiOS 7.4 · Lesson 8 of 12

Remote access: SSL-VPN portal is not the same as IPsec RA

Priya is at home. Two common FortiGate answers: SSL-VPN (browser bookmark or FortiClient tunnel to a portal) and IPsec remote access (FortiClient / native IKEv2). They fail differently, patch differently, and split-tunnel differently. Also: SSL-VPN has a long CVE history — design like it will be scanned.

Updated 2026-08-18·18 min read·L2 primary·Quiz at end

After this page you can

Choose SSL-VPN vs IPsec RA for a user population.
Set split tunnel so home internet does not hairpin.
Lock the portal (realm, MFA, restrict access, patch).
Prove with SSL-VPN status / FortiClient and a sourced ping.

The ticket

Home internet died for every SSL-VPN user. Split tunnel was off. All YouTube now goes HQ WAN. Meanwhile the portal is on the WAN with password-only. Two problems, one product name.

Quick interview answer

SSL-VPN terminates TLS to a portal (web bookmarks and/or tunnel mode). IPsec RA uses IKE + FortiClient or native IKEv2. Split tunnel = only corp prefixes via VPN. FortiOS 7.4: VPN → SSL-VPN Settings (listen interface, port, certificate, IP pools) + portal + user group + firewall policy from ssl.root to LAN. Treat internet-facing SSL-VPN as a high-value attack surface — MFA, restrict source, stay patched, or prefer IPsec/ZTNA.

Home user SSL-VPN versus IPsec remote access — Split tunnel is a design choice, not a checkbox you forget.

Lab data · dummy only

FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60. RFC 5737. Not a customer.

Mental model

	SSL-VPN	IPsec RA
Client	Browser and/or FortiClient	FortiClient / native IKEv2
Listen	HTTPS portal (custom port)	UDP 500/4500
Policy from	ssl.root (tunnel mode)	The RA tunnel interface / dialup
Risk	Internet HTTPS app + CVE history	IKE brute / weak PSK

https://fgt-hq.techclick-lab.in

Training mock · not live

Admin

DashboardPolicyVPNNetwork

VPN → SSL-VPN Settings

Listen on WAN

Listen on Interface(s)

port1 (WAN)

Listen on Port

10443 (not 443 if VIP uses 443)

Idle timeout

300

Address range

10.20.40.0/24

Split Tunneling

Enabled — 10.20.30.0/24 only

FortiOS 7.4 SSL-VPN Settings. Training mock.

How to choose

Contractors who refuse an agent: SSL-VPN web. Managed laptops: IPsec RA or FortiClient + MFA. Long term: ZTNA / SASE (VPN series lesson 1). Never expose password-only SSL-VPN to 0.0.0.0/0 if you can avoid it.

Runbook

Side A — portal
Certificate, port, realm, group TECHCLICK\VPN. MFA if you have it.
Side B — policy
ssl.root → LAN, dest 10.20.30.0/24, log. Split tunnel routing address = that dest.
Side C — prove
User gets 10.20.40.10. Ping 10.20.30.10 works. 1.1.1.1 does not go via HQ (tracert).

Who is on SSL-VPN

get vpn ssl monitor
# index   user    assigned  remote
# 0       priya   10.20.40.10  198.51.100.80

diagnose firewall auth list

Four failures

1 · Portal on 443 fights the VIP

Move SSL-VPN to 10443 or move admin/VIP.

2 · Full tunnel by accident

WAN melts. Enable split or size the WAN.

3 · Policy from WAN not ssl.root

Tunnel mode users never match.

4 · Unpatched SSL-VPN

This is not theoretical. Patch, restrict, MFA, or replace.

How to prove it

Close only when

1) User in ssl monitor. 2) Split works. 3) MFA or at least not a shared password. 4) You know the FortiOS build.

Traps

Symptom	Cause
Connects, no apps	Missing ssl.root → LAN policy / DNS
Cert warning	Portal cert ≠ hostname

FortiGate class series: FGT / FMG / FAZ · First day · Policy first match · SNAT vs VIP · Profiles + SSL · debug flow · IPsec S2S · SSL-VPN vs RA · SD-WAN SLA · VDOM · FGCP HA · Interview