Netskope LogoNetskope Logo
  • Security Services
  • AI Services
  • Networking Services
  • Analytics Services
  • Integrations
  • getting-started.svgGetting Started
    • Support
    • Community
    • Netskope.com
    © 2026 All Rights Reserved. Netskope Inc.
    Home
    Netskope Client
    Netskope Client Interoperability
    VPN Applications
    FortiGate VPN

    FortiGate VPN

    FortiGate VPN enables secure communications across various endpoints on the internet. This document contains the best practices required in FortiGate VPN and Netskope Client to ensure smooth interoperability.

    Environments

    • FortiGate Server version: FortiOS v7.2.0-b1157
    • FortiGate Client version: 7.4.7.1928
    • Netskope Client version: 138.0.0

    Interoperability Configuration Requirements

    Specific configurations in FortiGate VPN and Netskope tenant web UI ensure processes or traffic from either of the applications are not blocked or directed to the Netskope Cloud. This interoperability configuration is comprised with the following steps:

    • Address Configuration in FortiGate

    • Configuration In FortiGate VPN

    • Configuration in Netskope Client

    Address Configuration in FortiGate

    Set up network addresses before configuring VPN tunnel. These addresses are primarily used for the following purposes:

    • Split Tunnel: To allow specific addresses to go through the VPN.

    • Full Tunnel with Exclusion: To allow specific addresses to bypass the VPN.

    To learn more, view Address objects.
    Address Configuration comprises three following steps of configuration:

    • Add Addresses

    • Add Address in Firewall Policy

    • Add Address in Policy Routes (Routing Override)

      Add Address

      To configure Address, f perform the following steps:

      1. Log into the FortiGate web interface.

      2. Go to Policy & Objects  > Addresses.

      3. Click + Create New or New.

      4. Create the following based on requirement:

        • Configure a Subnet

        • Configure an FQDN

        • Configure an IP Range

      Configure a Subnet

      A Subnet is a digital profile in FortiGate used to define and group an entire network range or a specific host IP address so it can be managed within firewall policies and routing rules.To learn more, view Subnet. 

      To configure Subnet, perform the following steps:

      1. In Name, enter a name (e.g., Internal-Network, DMZ-Subnet).

      2. In Color, click Change to assign a color for visual identification (Optional).

      3. In Type, select Subnet from the dropdown menu.

      4. In IP/Netmask, enter the network address and netmask.

        • Format: 192.168.1.0/24 or 192.168.1.0 255.255.255.0

        • Example: 10.0.0.0/8, 172.16.0.0/16

      5. Select the interface or leave as any in Interface.

      6. Toggle to enable Static route configuration (Optional).

      7. In Comments, add a description for documentation (Optional).

      8. Click OK to save.

      Configure an FQDN

      An FQDN (Fully Qualified Domain Name) is a digital profile in FortiGate used to define a specific domain name (such as salesforce.com) instead of a static IP, allowing the firewall to track and apply security rules to dynamically changing website addresses. To learn more, view FQDN addresses. 

      To configure FQDN, perform the following steps:

      1. In Name, enter a name (e.g., Google-DNS, Company-Website).

      2. In Type, select FQDN from the dropdown menu.

      3. In FQDN, enter the domain name.

        Example: www.example.com, *.google.com

      4. In Interface configure the interface (usually set to any for external domains).

      5. Click OK to save.

      Configure an IP Range

      An IP Range is a digital profile in FortiGate used to define a continuous block of consecutive IP addresses (such as 192.168.1.100 to 192.168.1.200) that do not conform to a standard subnet mask boundary, making it ideal for managing groups of specific assets like a static server blocks. To learn more, view IP Range.

      To configure IP Range perform the following steps:

      1. In Name, enter a name (e.g., DHCP-Pool-Range).

      2. In Type, select IP Range from the dropdown menu.

      3. In Start IP, enter the starting IP address.

      4. In End IP, enter the ending IP address.

        Example: Start: 192.168.1.100, End: 192.168.1.200

      5. Configure other fields as needed and click OK to save.

      Add Address in Firewall Policy

      This configuration maps the defined network assets to active security parameters, allowing the FortiGate firewall to identify, permit, or block traffic. This configuration is tunnel type specific. To learn more, view Firewall Policy under Split Tunnel Mode: Enabled based on Trusted Destination and Split Tunnel: Enabled based on Policy Destination.

      Add Address in Policy Routes (Routing Override)

      This configuration is to bypass the firewall’s standard destination-based routing table by forcing specific networks, users, or protocols to take a customized path through a designated gateway and network interface. 
      Note: Policies are processed top-to-bottom. More specific rules should be placed above generic rules. Use drag and drop to reorder policies.

      To add address in Policy Routes (Routing Override), perform the following steps:

      1. Navigate to Network > Policy Routes.

      2. Click + Create New.

      3. Configure the following Policy Route details:

        • Incoming Interface: Select interface (e.g., port1).

        • Source: Click the field and select address (e.g., Internal-LAN or Web-Server-01).

        • Destination: Click the field and select the destination address (e.g., Remote-Office-Network = 10.20.0.0/24), or use all for default routing.

        • Protocol: Select protocol (e.g., TCP, UDP, ALL).

        • Destination Port: Specify if needed (e.g., 443 for HTTPS).

        • Gateway Address: Enter the gateway IP (e.g., 192.168.1.1).

        • Outgoing Interface: Select outgoing interface (e.g., port2).

        • Comments: Add a description.

      4. Click OK.

      Common Routing Override Scenario: Route Guest Network Through Specific ISP

      This configuration redirects all guest internet traffic out through a secondary ISP line to protect primary internal bandwidth and isolate visitor activity.

      • Source: Guest-Network (192.168.100.0/24).

      • Destination: all

      • Gateway: 203.0.113.1 (ISP2 Gateway)

      • Outgoing Interface: port3

    Configurations In FortiGate VPN

    • Split Tunnel: Enabled based on Trusted Destination– This behaves like a Full Tunnel with Exclusions. It sends all traffic through the VPN unless the destination is explicitly listed as trusted. To learn more, view Enabling split tunnel feature for SSL VPN using Trusted Destinations.
    • Split Tunnel: Enabled based on Policy Destination– This is the standard split tunnel. Only traffic destined for specific internal networks defined in the VPN’s protected subnets configuration goes through the VPN. Everything else uses the user’s local internet. To learn more, view Enabling split tunnel feature for SSL VPN using policy destination.

    Create SSL VPN Split Tunnel Mode: Enabled based on Trusted Destination

    Before you begin, go to Network > Interfaces to:

    • Verify whether the IP address on WAN (External port) and internal port is assigned with the IP address.
    • Else, edit the WAN and Internal interface and set the IP and subnet mask based on the Subnets.

    Configure user and user group

    • Go to User > Authentication > User Definition to create a local user.

    • Go to User > Authentication > User Groups to create a group along with the local user.

    Configure SSL VPN Web Portal

    1. Go to VPN > SSL-VPN Portals > Edit SSL-VPN Portal and select Enabled Based on Trusted Destination.

    2. Add the IP ranges under the Routing Address Override field to exclude that traffic from entering the VPN tunnel. 

      Note: Wildcard FQDNs (e.g., `*.google.com`) are not supported by FortiOS within the SSL VPN Routing Address Override field. Only use exact Static FQDN  (e.g., `salesforce.com`) for leveraging Trusted Destination exclusions.

    Configure SSL VPN Settings

    • Go to VPN > SSL-VPN Settings and enter the following:

      1. In Listen on Interface(s) select wan1 (or Port1).

      2. In Listen on Port enter 10443.

      3. In Server Certificate choose a certificate for Server Certificate. The default is Fortinet_Factory.

      4. Enter a name to set the portal type in Authentication/Portal Mapping All Other Users/Groups.

      5. Create new Authentication/Portal Mapping for configured user group and map it to the configured portal.

    Configure SSL VPN  Firewall Policy

    To configure Internal Access Policy, follow the steps:

    1. Go to Policy & Objects > Firewall Policy.

    2. Enter the firewall policy name.

    3. Set Incoming Interface to SSL-VPN tunnel interface(ssl.root).

    4. Set Outgoing Interface to port2.

    5. Set the Source Address to all and User to configured user group.

    6. Set Destination to ALL.

    7. Set Schedule to always.

    8. Set Service to ALL.

    9. Select Accept in Action.

    10. Click OK.

    To configure Internet Access Policy follow the steps:

    1. Go to Policy & Objects > Firewall Policy.

    2. Enter the firewall policy name.

    3. Set Incoming Interface to SSL-VPN tunnel interface(ssl.root).

    4. Set Outgoing Interface to wan1.

    5. Set the Source Address to all and User to configured user group.

    6. Set Destination to ALL.

    7. Set Schedule to always.

    8. Set Service to ALL.

    9. Select Accept in Action.

    10. Click OK.

    Create SSL VPN Split Tunnel Mode: Enabled based on Policy Destination

    Refer to the following sections to define the split tunnel settings.

    Configure SSL VPN Web Portal

    1. Go to VPN > SSL-VPN Portals to create a tunnel mode only portal my-split-tunnel-portal.

    2. Enable Split Tunneling.

    Configure SSL VPN settings

    1. Go to VPN > SSL-VPN Settings.

    2. In Listen on Interface(s), select wan1 (or Port1 as per the AWS Deployment).

    3. Set Listen on Port to 10443.

    4. Choose a certificate for Server Certificate. The default is Fortinet_Factory.

    5. In the Authentication/Portal Mapping table, click Create New to map the configured user group to configured portal.

    6. In the All Other Users/Groups, set the default Portal to configured portal.

    Configure SSL VPN Firewall Policy

    1. Go to Policy & Objects > Firewall Policy.

    2. Enter the firewall policy name. Example, sslvpn Split Tunnel Access.

    3. Incoming interface must be SSL-VPN tunnel interface (ssl.root).

    4. Choose Outgoing Interface. Example, port1.

    5. Set the Source to all and group to configured user group.

    6. Add the FQDN resources(e.g., salesforce.com) that need to be tunnelled through VPN under Destination.

    7. Set Schedule to always.

    8. Set Service to ALL.

    9. Select Accept in Action.

    10. Click OK.

    Configurations In Netskope Client

    When installing Netskope Client along with a VPN client, configure exceptions in steering configurations to bypass traffic from the VPN client. To learn more about adding exceptions for third-party VPN apps, view Exceptions.

    Create a Network Location

    To add the VPN gateway server URL in Netskope Policy :

    1. Go to Policies > Profiles > Network Location > New Network Location and select either Single Object or Multiple Objects.

    2. To add a Single Object, provide an IP address, IP address range, or a CIDR netmask, When finished, click the adjacent + button, and then click Next. Enter a name for the network location, and then click Save Network Location.

    3. To add Multiple Objects, upload a CSV file with multiple IP addresses or ranges. Enter a name for the network locations, and then click Save Network Location.

    4. When finished, click Apply Changes.

    Create Destination Location Exception

    1. To add a Destination Location exception, go to the Steering Configuration page and select a configuration.

    2. In the EXCEPTIONS tab, click NEW EXCEPTION drop down list and select Destination Location.

    3. n the New Exception pop-up window, enter select the Network Location profile from the list.

    4. Click ADD to complete the process.

      Verifying Interoperability

      FortiGate VPN Validation

      Ensure that traffic is going through the VPN.

      Netskope Client Functions

      Refer to the list of validated use cases that you can use to verify Client operations.

    In this Topic
    • FortiGate VPN