FortiGate Administration Guide - FirewallShop.com

Firewall Policy
Configuring firewall policies
Note: For a route-based (interface mode) VPN, you do not configure an IPSEC firewall
policy. Instead, you configure two regular ACCEPT firewall policies, one for each direction
of communication, with the IPSec virtual interface as the source or destination interface as
appropriate.
For more information, see the “Defining firewall policies” chapter of the FortiGate
IPSec VPN User Guide.
SSL-VPN firewall policy options
When Action is set to SSL-VPN, the following options are available:
Note: The SSL-VPN option is available from the Action list after one or more SSL VPN user
groups have been created. To create user accounts and SSL VPN user groups, see
“Configuring SSL VPN user group options” on page 392.
Figure 170:SSL-VPN encryption policy
SSL Client
Certificate
Restrictive
Cipher Strength
User
Authentication
Method
Allow traffic generated by holders of a (shared) group certificate. The
holders of the group certificate must be members of an SSL VPN user
group, and the name of that user group must be present in the Allowed
field.
Select one of the following options to determine the level of SSL
encryption to use. The web browser on the remote client must be
capable of matching the level that you select:
• To use any cipher suite, select Any.
• To use a 164-bit or greater cipher suite, select High >= 164.
• To use a 128-bit or greater cipher suite, select Medium >= 128.
Select one of the following options:
• If the user group that will be bound to this firewall policy is a local user
group, select Local.
• If the remote clients will be authenticated by an external RADIUS
server, select Radius.
• If the remote clients will be authenticated by an external LDAP server,
select LDAP.
• Select Any to enable all of the above authentication methods. Local is
attempted first, then Radius, then LDAP.
Available Groups Select the name of the user group requiring SSL VPN access, and then
select the right-pointing arrow. Do not select more than one user group
unless all members of the selected user groups have identical access
requirements.
For information about how to create a firewall encryption policy for SSL VPN
users, see the “SSL VPN administration tasks” chapter of the FortiGate SSL VPN
User Guide.
FortiGate Version 3.0 MR5 Administration Guide
01-30005-0203-20070830 281