FortiGate VPN enables secure communications across various endpoints on the internet. This document contains the best practices required in FortiGate VPN and Netskope Client to ensure smooth interoperability.
Environments
- FortiGate Server version: FortiOS v7.2.0-b1157
- FortiGate Client version: 7.4.7.1928
- Netskope Client version: 138.0.0
Interoperability Configuration Requirements
Specific configurations in FortiGate VPN and Netskope tenant web UI ensure processes or traffic from either of the applications are not blocked or directed to the Netskope Cloud. This interoperability configuration is comprised with the following steps:
Address Configuration in FortiGate
Set up network addresses before configuring VPN tunnel. These addresses are primarily used for the following purposes:
-
Split Tunnel: To allow specific addresses to go through the VPN.
-
Full Tunnel with Exclusion: To allow specific addresses to bypass the VPN.
To learn more, view Address objects.
Address Configuration comprises three following steps of configuration:
-
Add Address in Policy Routes (Routing Override)
Add Address
To configure Address, f perform the following steps:
-
Log into the FortiGate web interface.
-
Go to Policy & Objects > Addresses.
-
Click + Create New or New.
-
Create the following based on requirement:
Configure a Subnet
A Subnet is a digital profile in FortiGate used to define and group an entire network range or a specific host IP address so it can be managed within firewall policies and routing rules.To learn more, view Subnet.
To configure Subnet, perform the following steps:
-
In Name, enter a name (e.g., Internal-Network, DMZ-Subnet).
-
In Color, click Change to assign a color for visual identification (Optional).
-
In Type, select Subnet from the dropdown menu.
-
In IP/Netmask, enter the network address and netmask.
-
Format: 192.168.1.0/24 or 192.168.1.0 255.255.255.0
-
Example: 10.0.0.0/8, 172.16.0.0/16
-
-
Select the interface or leave as any in Interface.
-
Toggle to enable Static route configuration (Optional).
-
In Comments, add a description for documentation (Optional).
-
Click OK to save.
Configure an FQDN
An FQDN (Fully Qualified Domain Name) is a digital profile in FortiGate used to define a specific domain name (such as salesforce.com) instead of a static IP, allowing the firewall to track and apply security rules to dynamically changing website addresses. To learn more, view FQDN addresses.
To configure FQDN, perform the following steps:
-
In Name, enter a name (e.g., Google-DNS, Company-Website).
-
In Type, select FQDN from the dropdown menu.
-
In FQDN, enter the domain name.
Example: www.example.com, *.google.com
-
In Interface configure the interface (usually set to any for external domains).
-
Click OK to save.
Configure an IP Range
An IP Range is a digital profile in FortiGate used to define a continuous block of consecutive IP addresses (such as 192.168.1.100 to 192.168.1.200) that do not conform to a standard subnet mask boundary, making it ideal for managing groups of specific assets like a static server blocks. To learn more, view IP Range.
To configure IP Range perform the following steps:
-
In Name, enter a name (e.g., DHCP-Pool-Range).
-
In Type, select IP Range from the dropdown menu.
-
In Start IP, enter the starting IP address.
-
In End IP, enter the ending IP address.
Example: Start: 192.168.1.100, End: 192.168.1.200
-
Configure other fields as needed and click OK to save.
Add Address in Firewall Policy
This configuration maps the defined network assets to active security parameters, allowing the FortiGate firewall to identify, permit, or block traffic. This configuration is tunnel type specific. To learn more, view Firewall Policy under Split Tunnel Mode: Enabled based on Trusted Destination and Split Tunnel: Enabled based on Policy Destination.
Add Address in Policy Routes (Routing Override)
This configuration is to bypass the firewall’s standard destination-based routing table by forcing specific networks, users, or protocols to take a customized path through a designated gateway and network interface.
Note: Policies are processed top-to-bottom. More specific rules should be placed above generic rules. Use drag and drop to reorder policies.To add address in Policy Routes (Routing Override), perform the following steps:
-
Navigate to Network > Policy Routes.
-
Click + Create New.
-
Configure the following Policy Route details:
-
Incoming Interface: Select interface (e.g., port1).
-
Source: Click the field and select address (e.g., Internal-LAN or Web-Server-01).
-
Destination: Click the field and select the destination address (e.g., Remote-Office-Network = 10.20.0.0/24), or use all for default routing.
-
Protocol: Select protocol (e.g., TCP, UDP, ALL).
-
Destination Port: Specify if needed (e.g., 443 for HTTPS).
-
Gateway Address: Enter the gateway IP (e.g., 192.168.1.1).
-
Outgoing Interface: Select outgoing interface (e.g., port2).
-
Comments: Add a description.
-
-
Click OK.
Common Routing Override Scenario: Route Guest Network Through Specific ISP
This configuration redirects all guest internet traffic out through a secondary ISP line to protect primary internal bandwidth and isolate visitor activity.
-
Source: Guest-Network (192.168.100.0/24).
-
Destination: all
-
Gateway: 203.0.113.1 (ISP2 Gateway)
-
Outgoing Interface: port3
-
Configurations In FortiGate VPN
- Split Tunnel: Enabled based on Trusted Destination– This behaves like a Full Tunnel with Exclusions. It sends all traffic through the VPN unless the destination is explicitly listed as trusted. To learn more, view Enabling split tunnel feature for SSL VPN using Trusted Destinations.
- Split Tunnel: Enabled based on Policy Destination– This is the standard split tunnel. Only traffic destined for specific internal networks defined in the VPN’s protected subnets configuration goes through the VPN. Everything else uses the user’s local internet. To learn more, view Enabling split tunnel feature for SSL VPN using policy destination.
Create SSL VPN Split Tunnel Mode: Enabled based on Trusted Destination
Before you begin, go to Network > Interfaces to:
- Verify whether the IP address on WAN (External port) and internal port is assigned with the IP address.
- Else, edit the WAN and Internal interface and set the IP and subnet mask based on the Subnets.
Configure user and user group
-
Go to User > Authentication > User Definition to create a local user.
-
Go to User > Authentication > User Groups to create a group along with the local user.
Configure SSL VPN Web Portal
-
Go to VPN > SSL-VPN Portals > Edit SSL-VPN Portal and select Enabled Based on Trusted Destination.
-
Add the IP ranges under the Routing Address Override field to exclude that traffic from entering the VPN tunnel.
Note: Wildcard FQDNs (e.g., `*.google.com`) are not supported by FortiOS within the SSL VPN Routing Address Override field. Only use exact Static FQDN (e.g., `salesforce.com`) for leveraging Trusted Destination exclusions.
Configure SSL VPN Settings
-
Go to VPN > SSL-VPN Settings and enter the following:
-
In Listen on Interface(s) select wan1 (or Port1).
-
In Listen on Port enter 10443.
-
In Server Certificate choose a certificate for Server Certificate. The default is Fortinet_Factory.
-
Enter a name to set the portal type in Authentication/Portal Mapping All Other Users/Groups.
-
Create new Authentication/Portal Mapping for configured user group and map it to the configured portal.
-
Configure SSL VPN Firewall Policy
To configure Internal Access Policy, follow the steps:
-
Go to Policy & Objects > Firewall Policy.
-
Enter the firewall policy name.
-
Set Incoming Interface to SSL-VPN tunnel interface(ssl.root).
-
Set Outgoing Interface to port2.
-
Set the Source Address to all and User to configured user group.
-
Set Destination to ALL.
-
Set Schedule to always.
-
Set Service to ALL.
-
Select Accept in Action.
-
Click OK.
To configure Internet Access Policy follow the steps:
-
Go to Policy & Objects > Firewall Policy.
-
Enter the firewall policy name.
-
Set Incoming Interface to SSL-VPN tunnel interface(ssl.root).
-
Set Outgoing Interface to wan1.
-
Set the Source Address to all and User to configured user group.
-
Set Destination to ALL.
-
Set Schedule to always.
-
Set Service to ALL.
-
Select Accept in Action.
-
Click OK.
Create SSL VPN Split Tunnel Mode: Enabled based on Policy Destination
Refer to the following sections to define the split tunnel settings.
Configure SSL VPN Web Portal
-
Go to VPN > SSL-VPN Portals to create a tunnel mode only portal my-split-tunnel-portal.
-
Enable Split Tunneling.
Configure SSL VPN settings
-
Go to VPN > SSL-VPN Settings.
-
In Listen on Interface(s), select wan1 (or Port1 as per the AWS Deployment).
-
Set Listen on Port to 10443.
-
Choose a certificate for Server Certificate. The default is Fortinet_Factory.
-
In the Authentication/Portal Mapping table, click Create New to map the configured user group to configured portal.
-
In the All Other Users/Groups, set the default Portal to configured portal.
Configure SSL VPN Firewall Policy
-
Go to Policy & Objects > Firewall Policy.
-
Enter the firewall policy name. Example, sslvpn Split Tunnel Access.
-
Incoming interface must be SSL-VPN tunnel interface (ssl.root).
-
Choose Outgoing Interface. Example, port1.
-
Set the Source to all and group to configured user group.
-
Add the FQDN resources(e.g., salesforce.com) that need to be tunnelled through VPN under Destination.
-
Set Schedule to always.
-
Set Service to ALL.
-
Select Accept in Action.
-
Click OK.
Configurations In Netskope Client
When installing Netskope Client along with a VPN client, configure exceptions in steering configurations to bypass traffic from the VPN client. To learn more about adding exceptions for third-party VPN apps, view Exceptions.
Create a Network Location
To add the VPN gateway server URL in Netskope Policy :
-
Go to Policies > Profiles > Network Location > New Network Location and select either Single Object or Multiple Objects.
-
To add a Single Object, provide an IP address, IP address range, or a CIDR netmask, When finished, click the adjacent + button, and then click Next. Enter a name for the network location, and then click Save Network Location.
-
To add Multiple Objects, upload a CSV file with multiple IP addresses or ranges. Enter a name for the network locations, and then click Save Network Location.
-
When finished, click Apply Changes.
Create Destination Location Exception
-
To add a Destination Location exception, go to the Steering Configuration page and select a configuration.
-
In the EXCEPTIONS tab, click NEW EXCEPTION drop down list and select Destination Location.
-
n the New Exception pop-up window, enter select the Network Location profile from the list.
-
Click ADD to complete the process.
Verifying Interoperability
FortiGate VPN Validation
Ensure that traffic is going through the VPN.
Netskope Client Functions
Refer to the list of validated use cases that you can use to verify Client operations.