Can forticlient do this?

[chris_hdez]

Hello,

In our environment we have a Fortigate 100 D, I'm planning to deploy in all laptop a VPN client, ideally at the end, would be great to get this done:

- Detect if user is in our facilities or not, there's no need to connect vpn if users are in the office.  So if any user goes away, vpn tunnel should connect automatically.

- Should use AD credentials, as you all know, the more passwords we have, the more support requests IT department will suffer, all laptops are protected by Active Directory credentials, so somehow security in VPN connection should be automated.

The goal is to offer VPN benefits but without any user interaction...all traffic should be routed to VPN, even Internet connections

Anyone have any experience on this?

Thank you.

[MikePruett]

Yes you can do that. Fortinet has a pretty good video about this.

https://video.fortinet.co...n-with-forticlient-5-2

[chris_hdez]

Thank you Mike, I'm going to eat that video right now!

[chris_hdez]

Seems that is using Fortigate DHCP to detect if any computer is off the network, any chance to do this using Windows DHCP service instead of Fortigate?

Regards,

[emnoc]

I don't believe the on or off-net has anything todo with  DHCP.

e.g

what if some one "static  assigns" there laptop.

Ken

[Carl_Wallmark · Accepted solution]

The FortiClient relies on "ON-net/OFF-net" detection to do the tunnel.

On-net/off-net can be based on:

1.

The network you are on, let´s say 192.168.1.0/24 is considered ON-net = no tunnel

You can also specify the MAC address of your default gateway if you are on the above network.

2.

The FortiGate can add an option in the DHCP request which the FortiClient will detect, no option = you are off-net and tunnel will go up

3.

You can also use that option in a third-party DHCP, like Windows Server, add the option and specify the S/N of a firewall.

You can also make the FortiClient ping different gateways and it will choose the one with lowest latency.

EDIT:

For password, you can save the password in FortiClient, however, the user needs to save the password the first time, there is no "single-sign-on". Well, there is an option to start the tunnel when you log in to the computer, then there is a "single-sign-on"

For routing, you only need to push out 0.0.0.0/0.0.0.0 as network, and all traffic will go through the tunnel, only make sure you have firewall policies on the firewall, like SSLVPN -> WAN1, Nat enabled and all your security profiles.

[MikePruett]

Sorry Chris, got hung up and didn't see your responses. Selective and the others covered the bases though!

[chris_hdez]

Thank you all!

I'm checking on all those points, I'm about to upgrade FortiOS to last stable version, meanwhile, I'm kind of stuck in Forticlient, I can just see basic options (just to create a vpn connection and get connected), acording to the video, some options must be enabled in Forticlient before exporting configuration and I can't see those options, I'll keep working on that.

I apreciate your help, thank you

Regards,

[C4]

Check out the client configurator.  It will allow you customize the client using XML.  After the client is customized you can deploy the customized version, with your desired settings.