Skip to main content

How to setup a Host-Check for Fortigate SSL VPN

This document outlines how to setup a host-check for a Fortigate SSL VPN (Web only):

config vpn ssl web portal
edit "portalname"
set web-mode enable
set host-check custom
set host-check-policy "Microsoft-Windows-Firewall"
set os-check-enable
set ip-pools "PoolName"
set split-tunneling disable
set page-layout double-column
set theme orange
config os-check-list "windows-7"
set action check-up-to-date
set latest-patch-level 1
end 

config vpn ssl web host-check-software
edit "Microsoft-Windows-Firewall"
config check-item-list
edit 1
set target "HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile:EnableFirewall==1"
set type registry
next
edit 2
set target "HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\PublicProfile:EnableFirewall==1"
set type registry
next
edit 3
set target "HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\DomainProfile:EnableFirewall==1"
set type registry
next
end
set type fw
next

With the above commands, it'll basically create a custom web portal that only allows Web Access and allows Windows 7 to connect as long as it is up to date with the latest patch level as least 1 away from current. In addition to that, it applies a host check based on all three Firewalls needing to be enabled as defined by the Registry keys. This can also be used to check other keys if needed.
Labels:

Comments

  1. bretton atkinMay 13, 2019 at 2:55 AM


    I would say That a Fortinet NSE4-FortiOS 6.0 Certification is highly respected With Both IT & non-IT communities where strong project management skills are required. I would suggest getting your NSE4-FortiOS 6.0 Certification. You can prepare yourself for the NSE4_FGT-6.0 questions to get Fortinet NSE4-FortiOS 6.0 credentials.

    ReplyDelete
  2. Fayaz Ahmed 234December 10, 2019 at 1:31 PM

    domchimp.com/tools/ssl-checker

    ReplyDelete
  3. nikhilApril 16, 2020 at 4:53 PM

    thanks for the blog CISCO Meraki Switches Firewall

    ReplyDelete

Post a Comment

Popular posts from this blog

Implementing 802.1X - Windows 2012R2 + Cisco 4500 Switches

Implementing 802.1X Using Windows Server 2012R2 & Cisco 4500 Series Switches Overview: This document is to outline how the configuration between Windows Server 2012 R2’s NPS Services and Cisco 4500 Series switches has been implemented. High Level Diagram:   Requirements: Windows Server 2012 R2 with NPS Server installed Windows Server 2012 R2 with CA Services Windows AD Environment Cisco 4500 Series Switches Windows 7-10 Clients to connect NPS Configuration: 1. This assumes the above requirement that the NPS Service has already been installed on Windows Server 2012 R2 2. Disable all existing Policies under Connection Request Policies and Network Policies as you will be making your own, except one that states “Catch All” with the below parameters: 3. You will then need to add in a new Radius Client to have Policies built around. Friendly Name will be used going forward for the Policies for referencing the document. 4. Once completed...
Post a Comment
Read more

OVA/OVF Templates and Older Versions of VMware ESXI

Recently ran into this issue which I feel is something that I should document, as it provides some additional details onto how to configure or modify an existing .ova or .ovf file which is the standard deployment template for ESXI/VMware. Here was the issue: - ESXI 5.5 - OVA required hardware type 8. Gave an error of  " Unsupported hardware version - vmx-8" when testing. Based on everything I was reading, it isn't supported. So using the ovftool which can be found on VMware's Website ( here ) you can basically extract out the ova/ovf file into a directory, and then use it to modify the VMX file and then put it all back together. Steps: 1. Download the application and install it. 2. Go to the directory where the ovftool is stored via cmd line (Typically C:\Programs Files\Vmware\ect..) 3. Issue the following command: ovftool 4. Then modify the .vmx file so that it contains now the hardware ID of 7 (or whatever you need set for your release). 5. Then issu...
1 comment
Read more