# Remote access: SSL-VPN portal is not the same as IPsec RA Source: https://ai.techclick.in/blog_fortigate_sslvpn_vs_ipsec_ra Markdown: https://ai.techclick.in/blog_fortigate_sslvpn_vs_ipsec_ra.md Publisher: Techclick Infosec Pvt Ltd SSL-VPN portal vs IPsec / FortiClient remote access. Split tunnel. Dummy portal users.techclick-lab.in. ## The ticket Home internet died for every SSL-VPN user. Split tunnel was off. All YouTube now goes HQ WAN. Meanwhile the portal is on the WAN with password-only. Two problems, one product name. Quick interview answer SSL-VPN terminates TLS to a portal (web bookmarks and/or tunnel mode). IPsec RA uses IKE + FortiClient or native IKEv2. Split tunnel = only corp prefixes via VPN. FortiOS 7.4: VPN → SSL-VPN Settings (listen interface, port, certificate, IP pools) + portal + user group + firewall policy from ssl.root to LAN. Treat internet-facing SSL-VPN as a high-value attack surface — MFA, restrict source, stay patched, or prefer IPsec/ZTNA. Hero · home user Split tunnel is a design choice, not a checkbox you forget. Lab data · dummy only FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60 . RFC 5737. Not a customer. ## Mental model SSL-VPN IPsec RA Client Browser and/or FortiClient FortiClient / native IKEv2 Listen HTTPS portal (custom port) UDP 500/4500 Policy from ssl.root (tunnel mode) The RA tunnel interface / dialup Risk Internet HTTPS app + CVE history IKE brute / weak PSK https://fgt-hq.techclick-lab.in Training mock · not live Admin Dashboard Policy VPN Network VPN → SSL-VPN Settings ### Listen on WAN Listen on Interface(s) port1 (WAN) Listen on Port 10443 (not 443 if VIP uses 443) Idle timeout 300 Address range 10.20.40.0/24 Split Tunneling Enabled — 10.20.30.0/24 only Cancel Save FortiOS 7.4 SSL-VPN Settings. Training mock. ## How to choose Contractors who refuse an agent: SSL-VPN web. Managed laptops: IPsec RA or FortiClient + MFA. Long term: ZTNA / SASE (VPN series lesson 1). Never expose password-only SSL-VPN to 0.0.0.0/0 if you can avoid it. ## Runbook - #### Side A — portal Certificate, port, realm, group TECHCLICK\VPN. MFA if you have it. - #### Side B — policy ssl.root → LAN, dest 10.20.30.0/24, log. Split tunnel routing address = that dest. - #### Side C — prove User gets 10.20.40.10. Ping 10.20.30.10 works. 1.1.1.1 does not go via HQ (tracert). Who is on SSL-VPN get vpn ssl monitor # index user assigned remote # 0 priya 10.20.40.10 198.51.100.80 diagnose firewall auth list ## Four failures ### 1 · Portal on 443 fights the VIP Move SSL-VPN to 10443 or move admin/VIP. ### 2 · Full tunnel by accident WAN melts. Enable split or size the WAN. ### 3 · Policy from WAN not ssl.root Tunnel mode users never match. ### 4 · Unpatched SSL-VPN This is not theoretical. Patch, restrict, MFA, or replace. ## How to prove it Close only when 1) User in ssl monitor. 2) Split works. 3) MFA or at least not a shared password. 4) You know the FortiOS build. ## Traps Symptom Cause Connects, no apps Missing ssl.root → LAN policy / DNS Cert warning Portal cert ≠ hostname ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 Tunnel-mode SSL-VPN policies usually start from… WAN ssl.root FAZ port1 only always Correct: b . FortiOS ssl.root interface. Q2 Split tunnel means… All internet via HQ Only selected corp prefixes via VPN No encryption Two FortiManagers Correct: b . Concept. Q3 SSL-VPN on 443 and VIP on 443… Always fine Collide — move one Disables SNAT Fixes pinning Correct: b . Failure 1. Q4 Internet-facing SSL-VPN should at least have… MFA, restrict sources, current FortiOS Password admin / admin HTTP Any-any from ssl.root to WAN Correct: a . CVE caution. Q5 IPsec RA is often preferred for managed laptops because… It avoids an internet HTTPS portal attack surface It cannot split tunnel It needs no policy It replaces FAZ Correct: a . Choose. Q6 Proof Priya is on SSL-VPN? get vpn ssl monitor shows priya + assigned IP get system status VIP session FMG ADOM Correct: a . Runbook. Check answers Reset FortiGate class series: FGT / FMG / FAZ · First day · Policy first match · SNAT vs VIP · Profiles + SSL · debug flow · IPsec S2S · SSL-VPN vs RA · SD-WAN SLA · VDOM · FGCP HA · Interview ## Sources - FortiOS 7.4 — SSL-VPN (settings, portals, tunnel mode) . - FortiGuard PSIRT — treat SSL-VPN as a scanned surface . Related: FortiGate session factory · VPN series . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt