SSL VPN client download being redirected

Author
Michael Runyon
New Member
  • Total Posts : 2
  • Scores: 0
  • Reward points: 0
  • Joined: 2019/11/08 07:15:10
  • Location: Schenectady, NY
  • Status: offline
2019/11/08 07:47:25 (permalink)
0

SSL VPN client download being redirected

I have noticed that recently installed Fortigate 30E and 60E devices with SSL VPN configured are redirecting FortiClient downloads to https://forticlient.com/#downloads when selecting either the MacOSx or Windows installer from the Fortigate SSL VPN web portal. This is a change from earlier behavior that downloaded the client directly from the firewall. The behavior is the same regardless of browser used or OS. I've also seen it behave in this manner in FortiOS 6.0.5 and 6.0.6, although it does not seem to occur in 6.2.0 versions.
 
I've confirmed the option to allow FortiClient download is enabled. No custom download location is specified of course, since I want the download to come from the firewall. The config is pretty basic, as seen below.
 
config vpn ssl settings
    set servercert "WC2020_pfx12"
    set idle-timeout 7200
    set tunnel-ip-pools "SSLVPN_TUNNEL_ADDR1"
    set tunnel-ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"
    set dns-server1 192.168.1.15
    set dns-server2 8.8.8.8
    set port 443
    set source-interface "wan1"
    set source-address "all"
    set source-address6 "all"
    set default-portal "tunnel-access"
end


config vpn ssl web portal
    edit "tunnel-access"
        set tunnel-mode enable
        set ipv6-tunnel-mode enable
        set save-password enable
        set ip-pools "SSLVPN_TUNNEL_ADDR1"
        set ipv6-pools "SSLVPN_TUNNEL_IPv6_ADDR1"
        config split-dns
            edit 1
                set domains "<removed>"
                set dns-server1 192.168.1.15
            next
        end
    next
end
 
config firewall policy
    edit 4
        set name "SSL VPN Access"
        set uuid 48ef2084-fdad-51e9-b877-f079e3157c23
        set srcintf "ssl.root"
        set dstintf "internal"
        set srcaddr "SSLVPN_TUNNEL_ADDR1"
        set dstaddr "Office LAN"
        set action accept
        set schedule "always"
        set service "ALL"
        set groups "tacacs_group" "SSL VPN Users"
    next
end
 
Have others experienced similar behavior? I have an open ticket going with support, but they have indicated they cannot reproduce the behavior in their lab environments. Any help the community might offer on this would be most appreciated. Thanks for taking the time to look.
#1

0 Replies Related Threads

    Jump to:
    © 2019 APG vNext Commercial Version 5.5