Fortinet FORTIOS V3.0 MR7, Руководство пользователя

Страница: 17 / 90

Configuring a FortiGate SSL VPN Topology
FortiOS v3.0 MR7 SSL VPN User Guide
01-30007-0348-20080718
17
When the user initiates a VPN connection with the FortiGate unit through the SSL
VPN client, the FortiGate unit establishes a tunnel with the client and assigns the
client a virtual IP address from a range of reserved addresses. The client uses the
assigned IP address as its source address for the duration of the connection. After
the tunnel has been established, the user can access the network behind the
FortiGate unit.
Configuring the FortiGate unit to establish a tunnel with remote clients involves
selecting tunnel-mode access in the user group settings and enabling the feature
through SSL VPN configuration settings. The firewall policy and protection profiles
on the FortiGate unit ensure that inbound traffic is screened and processed
securely.
Tunnel-mode client requirements
The remote computer must be equipped with the following software:
• Microsoft Windows 2000/XP/2003 or Vista (32 or 64-bit), MacOS X v10.3.9,
v10.4 “Tiger”, v10.5 “Leopard”, or Linux Distributions RedHat/Fedora,
Ubuntu/Debian, or Suse
• Microsoft Internet Explorer 6.0 (or later) with ActiveX enabled, or Mozilla
Foundation/Firefox (1.5 or later) with Java Platform enabled
Topology
In the most common Internet scenario, the remote client connects to an ISP that
offers connections with dynamically assigned IP addresses. The ISP forwards
packets from the remote client to the Internet, where they are routed to the public
interface of the FortiGate unit.
At the FortiGate unit, you configure user groups and firewall policies to define the
server applications and IP address range or network that remote clients will be
able to access behind the FortiGate unit.
For example, Figure 1 shows a FortiGate gateway (FortiGate_1) to two private
networks, Subnet_1 and Subnet_2.
Note: The browser requirements only apply if you use the tunnel mode client on Windows
through the browser interface. You do not need a browser if you use the standalone tunnel
client.
Note: The user account used to install the SSL VPN client on the remote computer must
have administrator privileges.