SSL VPN, or Secure Sockets Layer Virtual Private Network, lets a remote user securely access a company’s internal network over the public internet. For the NSE7 exam, you must understand exactly how this technology works, how to deploy it on Fortinet firewalls, and how to troubleshoot when connections fail. Mastering SSL VPN is essential because it is the primary way organisations provide remote access to employees, and Fortinet’s implementation has specific settings, policies, and pitfalls that the exam loves to test.
Jump to a section
A simple way to picture SSL VPN and Remote Access
When you order a package online, the delivery service first brings it to your local depot, and that depot then assigns a trusted driver to bring it directly to your front door.
In the same way, an SSL VPN creates a secure tunnel from your remote computer to a specific point inside your company’s private network. Your web browser (the courier) first contacts a special server at the company’s edge, called an SSL VPN gateway. That gateway authenticates you by checking your username and password, just like the depot checks your delivery address and ID.
Once verified, the gateway builds an encrypted tunnel — a private, sealed corridor — between your computer and itself. All data you send or receive is scrambled inside that tunnel so even if someone intercepts it, they see only gibberish. This is very different from a standard website connection, which would be like leaving your package on the pavement and hoping no one steals it.
The SSL VPN gives you a direct, private path to access internal resources (file servers, email, database tools) as if you were physically sitting in the office. The gateway acts as the single secure entry point, controlling exactly who gets in and what they can reach. It is a precise, controlled, and guarded delivery system for your digital work.
SSL VPN stands for Secure Sockets Layer Virtual Private Network. Let's break that down.
'SSL' was an older security protocol, but the term is still used even though the modern version is TLS (Transport Layer Security). It is the same technology that puts the green padlock in your browser when you visit a secure website. 'VPN' means Virtual Private Network — a way to create a private, encrypted connection over a public network (like the internet). So an SSL VPN uses the browser’s encryption to build a secure tunnel from your device into a company’s private network.
Why does this exist? Before SSL VPNs, remote workers had to use dedicated leased lines or dial-up modems, which were expensive and slow. Then came IPsec VPNs, which worked well but required special client software on every device and often had compatibility issues with firewalls. The SSL VPN emerged as a simpler alternative: no client needed, because it works through a standard web browser.
How does it work in practice? When a remote user opens their browser and navigates to the company’s SSL VPN portal URL, their browser first makes a standard HTTPS connection (port 443) to the FortiGate firewall acting as the SSL VPN gateway. The FortiGate presents a digital certificate, proving its identity — similar to showing a badge. The browser then checks the certificate against a trusted authority; if it’s valid, the encrypted tunnel begins to form.
The user then logs in with their username and password (often plus a second factor like a code from an authenticator app). Once authenticated, the FortiGate checks the user’s security group membership and applies policies. These policies define exactly which internal resources the user can reach: maybe just email, or maybe also file servers and internal web apps.
There are two main modes for SSL VPN access on FortiGate:
Tunnel mode: This gives the remote user a virtual IP address on the company network. All traffic from the user’s device is routed through the encrypted tunnel, just like a traditional IPsec VPN. The user can access any internal IP address that the firewall policies allow.
Web mode (also called portal mode): The user accesses specific internal web applications through the SSL VPN portal. The FortiGate acts as a proxy, fetching the content and displaying it inside a web page. This is more secure because the user never gets a direct network connection — they only see the applications.
FortiGate also supports split-tunnelling. If split-tunnelling is enabled, only traffic destined for the company network goes through the VPN; everything else (like YouTube or Google) goes directly to the internet. This reduces bandwidth load on the company’s internet link. If split-tunnelling is disabled (full tunnel), all traffic from the remote device goes through the company network, which allows greater security monitoring but can be slower.
Authentication is a critical step. The FortiGate can use its local user database, or it can connect to an external identity provider like Microsoft Entra ID (formerly Azure Active Directory), LDAP, or RADIUS. The exam frequently tests that you know how to configure authentication realms and how certificates work.
In summary, SSL VPN replaces the need for expensive private circuits and complex client software. It leverages the browser’s built-in encryption to give remote users secure, policy-controlled access to internal resources. Understanding the difference between tunnel mode and web mode, the role of certificates, and the authentication process is central to both the real world and the NSE7 exam.
Navigating to the SSL VPN Settings
In the FortiGate GUI, go to 'VPN' → 'SSL VPN' → 'Settings'. Here you enable SSL VPN globally, choose the listening port (default 443), and select the interface. This step is the foundation; without it, no remote user can even reach the server.
Configuring Authentication
Go to 'User & Authentication' and create a local user or connect to an external server (LDAP, RADIUS, or Microsoft Entra ID). Optionally enable two-factor authentication via FortiToken. This step defines who is allowed to attempt a VPN connection and how they verify their identity.
Creating an SSL VPN Portal (Web Mode)
Under 'VPN' → 'SSL VPN' → 'Portals', create a portal that lists the internal web applications users can access. You can add bookmarks to specific URLs (like a CRM system). This step only applies if you plan to use web mode, giving users a simple browser-based interface.
Configuring the Tunnel Mode IP Pool
Go to 'Network' → 'IP Pools' and create a pool of internal IP addresses (e.g., 172.16.1.10-172.16.1.50). Go back to the SSL VPN settings and assign this pool to tunnel mode. This step ensures each tunnel mode user gets a unique address on the corporate network, preventing IP conflicts.
Creating Firewall Policies
Create a policy from the SSL VPN interface (ssl.root) to the internal network. Specify allowed source addresses (the IP pool), destination addresses (e.g., file server), services (e.g., SMB, HTTP), and the user groups. Without this policy, the tunnel exists but no traffic flows.
Testing and Troubleshooting
Have a remote user test the connection. If it fails, check the FortiGate logs (Log & Report) for authentication errors, expired certificates, or IP pool exhaustion. Use CLI commands like 'diagnose vpn ssl stats' to see active sessions. This step is where you apply all the configuration and fix real-world issues.
Imagine a medium-sized company, ‘Blue Rock Ltd’, with 200 employees. They have a main office in Manchester and 50 remote sales staff working from home across the UK. The IT team uses FortiGate firewalls at the head office.
One Monday morning, a sales representative, Sarah, needs to access the customer relationship management (CRM) system and a shared drive of contracts from her home laptop. Instead of driving two hours to the office, she opens her browser and goes to vpn.bluerock.co.uk. The page loads a login screen from the FortiGate SSL VPN portal. She enters her username and password, plus a one-time code from her phone’s authenticator app (two-factor authentication).
The FortiGate authenticates her against the company’s Microsoft Entra ID and checks that she belongs to the ‘Sales’ group. The firewall policy for the Sales group allows access to the CRM server (IP 192.168.10.50) and the file server (192.168.20.100), but blocks access to the finance database.
Sarah chooses tunnel mode because she needs direct access to the file server to run a specialised contract management tool that won’t work through a web interface. The FortiGate assigns her laptop a virtual IP address from a pool, like 172.16.1.50. Now her laptop behaves as if it is physically connected to the office LAN. She can browse the file server and use the CRM tool normally. All her traffic to the office is encrypted; her YouTube or Netflix traffic goes directly to the internet (because the IT team enabled split-tunnelling to save bandwidth).
Now, a problem. Sarah calls IT because the CRM tool is slow. The IT professional, Ravi, checks the FortiGate logs. He looks at the SSL VPN user statistics and sees that Sarah’s tunnel is up but shows high latency and packet loss. He checks the WAN link bandwidth — it is not saturated. He suspects the issue is with the user’s home internet. Ravi asks Sarah to test her home speed while connected and while disconnected; the problem is her Wi-Fi, not the VPN.
In a different scenario, a new remote worker, James, cannot connect at all. The login page loads, but after entering credentials, he gets a ‘connection failed’ error. Ravi checks the SSL VPN settings on the FortiGate: the tunnel mode IP pool is exhausted (all 20 addresses are assigned). He increases the pool size, and James connects.
What does an IT professional do with SSL VPN daily? They:
Create and modify SSL VPN policies to grant or restrict access based on user groups.
Monitor SSL VPN logs for failed authentication attempts (possible brute force attacks).
Troubleshoot certificate expiry when users see security warnings.
Adjust timeout settings to disconnect idle sessions and free up resources.
Update the SSL VPN portal page with company logos and links.
The real-world takeaway: SSL VPN is a daily tool for remote access. IT pros spend most of their time on policy configuration, log analysis, and troubleshooting connectivity issues — exactly the skills the NSE7 exam targets.
The NSE7 Advanced Security exam (NSE7) tests SSL VPN and remote access in objective 3.2, ‘Deploy and troubleshoot SSL VPN connections for remote users’. The exam is heavily practical — you must know the configuration steps on FortiGate CLI and GUI, and you must be able to diagnose why a connection fails.
Here are the exact concepts they love to test:
Tunnel mode vs web mode: You will get a scenario where a user needs direct network access or only web-based access. The correct answer is the appropriate mode. Trap: they might describe an application that requires a local client (like a database tool) — that forces tunnel mode.
Authentication methods: Options include local users, LDAP, RADIUS, certificate-based, and single sign-on (SSO) with Microsoft Entra ID. You must know which method is most suitable for a given setup and how to configure authentication realms. Trap: they might list a method that is not supported (e.g., NTLM without a domain controller).
Split-tunnelling: The exam will ask when to enable it (to reduce company bandwidth) and when to disable it (for compliance where all traffic must be inspected). Trap: they might call split-tunnelling a ‘security risk’ and ask for full tunnel. The exam expects you to know both benefits and drawbacks.
Certificates: You must know that the FortiGate needs a certificate trusted by clients. They often test the difference between a self-signed certificate (inexpensive but generates warnings) and a public CA-signed certificate (more expensive but trusted). Trap: they might say a self-signed certificate is fine for production — it is not, because users get security warnings.
IP pools and port forwarding: You must configure a range of IP addresses to assign to tunnel mode users. They like to test what happens when the pool runs out (new connections fail). Trap: answers suggesting that users share an IP address are incorrect.
Firewall policies: The SSL VPN traffic is processed through policy 64 (the built-in SSL VPN policy). Exam questions will ask which policy controls the traffic or how to allow a new service. Trap: they might point to a standard WAN-to-LAN policy instead.
Troubleshooting commands: You must know CLI commands like ‘diagnose vpn ssl stats’, ‘diagnose debug application sslvpn -1’, and ‘get vpn ssl settings’. Trap: they will include fake commands like ‘diagnose ssl vpn status’.
Two-factor authentication (2FA): FortiGate supports FortiToken, SMS, or third-party TOTP. The exam tests that you can enable 2FA per user or per group. Trap: they might suggest 2FA is optional even for remote access — the correct answer is that it is strongly recommended and often enforced in real deployments.
Common question types:
Multiple-choice: ‘Which SSL VPN mode should be used for accessing a thick client application?’
Drag-and-drop: Order steps to configure an SSL VPN from scratch.
Troubleshooting scenarios: ‘User can connect but cannot access the file server’ — you must identify that the firewall policy is missing or the authentication group is wrong.
To pass, memorise the settings under ‘Config → VPN → SSL VPN’ in the FortiGate GUI. Know the default port (10443 in some versions, 443 in others). Understand that web mode uses a portal page and tunnel mode uses a virtual adapter. Practise with the FortiGate documentation or a virtual lab. The exam expects you to think like an administrator, not just a theorist.
SSL VPN uses the browser’s HTTPS encryption (port 443) to create a secure tunnel, making it easy to deploy without client software.
FortiGate offers two modes: tunnel mode for full network access and web mode for proxied web applications only.
Access is controlled by firewall policies and user group memberships, not by the VPN tunnel itself.
Split-tunnelling routes only corporate traffic through the VPN, saving bandwidth, while full tunnel sends all traffic through the company network for security.
Two-factor authentication (2FA) is a critical security control for SSL VPN because single passwords are easily compromised.
When troubleshooting, always check the certificate validity, IP pool exhaustion, and authentication server configuration before blaming the user’s device.
The NSE7 exam expects you to know CLI diagnosis commands like 'diagnose vpn ssl stats' and the default order of SSL VPN policy (policy 64).
SSL VPN does not replace the need for endpoint security; a compromised device can tunnel malware into the corporate network.
Web mode uses a portal page where users see a list of accessible applications; tunnel mode assigns a virtual IP address from a pool.
Microsoft Entra ID (formerly Azure Active Directory) is a common authentication source for SSL VPN, and you must configure it as an LDAP or SAML provider.
These come up on the exam all the time. Here's how to tell them apart.
Tunnel Mode
Assigns the user a virtual IP address from a pool, making the device part of the internal network.
Supports any IP-based application, including thick clients like database tools or proprietary software.
Requires the FortiClient or a compatible third-party client to be installed on the remote device.
Web Mode
No virtual IP is assigned; the user accesses internal web apps through a browser portal.
Only works for web-based applications (HTTP/HTTPS) or applications that can be proxied.
No client software needed; the standard browser handles authentication and traffic.
Split-Tunnelling
Only corporate-bound traffic is sent through the VPN; other traffic goes directly to the internet.
Reduces bandwidth load on the company internet link.
Lower security because non-corporate traffic is not inspected or logged by the company firewall.
Full Tunnel
All traffic from the remote device is routed through the VPN and inspected by the company firewall.
Increases security assurance as all internet-bound traffic can be logged, filtered, and monitored.
Higher bandwidth consumption on the company internet link; may increase latency for general internet use.
Local User Authentication
Users are created and stored directly on the FortiGate in the local user database.
Simplest to set up for small deployments without an external directory.
When users change departments or leave, you must update each FortiGate manually.
LDAP Authentication
Authenticates against an external directory server (e.g., Microsoft Entra ID, OpenLDAP).
Centralises user management; changes in the directory propagate to all devices.
Requires network connectivity and correct LDAP configuration between the FortiGate and the directory server.
Self-Signed Certificate
Created by the FortiGate itself and not trusted by browsers by default.
Free and easy to generate but causes security warnings in clients.
Suitable only for testing, Proof of Concept, or strictly controlled environments where IT can push the certificate to all devices.
Public CA Certificate
Issued by a trusted Certificate Authority (e.g., DigiCert, Let's Encrypt) and automatically trusted by browsers.
More expensive (or free via Let's Encrypt) but ensures no warning prompts for users.
Required for production deployments where users connect from personal or managed devices that must trust the certificate.
Mistake
SSL VPN and IPsec VPN are basically the same thing, just different names.
Correct
They are fundamentally different. SSL VPN works over HTTPS (port 443) and is easier to pass through firewalls. IPsec VPN uses UDP ports 500 and 4500 and requires more complex network configuration. SSL VPN can often run without client software; IPsec always needs a client.
Both provide encrypted tunnels, so beginners assume the difference is just naming. In reality, the underlying protocols, port usage, and client requirements are completely different.
Mistake
Once the SSL VPN tunnel is up, the user has full access to all internal resources automatically.
Correct
Access is strictly controlled by firewall policies and user group memberships. The FortiGate administrator defines exactly which IP ranges, ports, and applications each user or group can reach. The tunnel only provides the encrypted path; the policy decides what goes through it.
People think 'VPN' means 'full network access' because that was true in older, simpler setups. Modern security demands least-privilege access, so administrators must deliberately configure permissions.
Mistake
SSL VPN is completely secure because it uses encryption, so no further security measures are needed.
Correct
Encryption protects data in transit, but the user device itself might be compromised (malware, keyloggers). Also, the login page could be targeted by brute-force attacks. Two-factor authentication, endpoint compliance checks, and strong password policies are still essential.
Crypto is often seen as a magic bullet. Beginners overlook the human and device factors, which are where most real-world breaches happen.
Mistake
If a user cannot connect, it is always a problem with the user's internet or their computer.
Correct
Many issues are caused by misconfiguration on the FortiGate: expired certificates, full IP pools, wrong authentication server settings, or timeouts on idle connections. The administrator must check logs and settings first.
Users blame their own equipment because they cannot see the server side. IT professionals know the server side is often the culprit, but beginners default to blaming the client.
Mistake
SSL VPN tunnel mode and web mode are interchangeable; you can use either for any type of application.
Correct
They serve different purposes. Tunnel mode provides direct network access for any IP-based application (including non-web apps). Web mode only works for web-based applications that can be proxied. If an application requires local ports or non-HTTP traffic, web mode will fail.
Beginners think 'VPN' is a single feature. They do not realise FortiGate offers two distinct modes with separate configuration and capabilities.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
The default port is 443 (HTTPS), but some versions use 10443. You can change it in the SSL VPN settings. Always check the actual configuration because network firewalls might block non-standard ports.
For web mode, no client is needed — it works entirely through a web browser. For tunnel mode, FortiGate offers the FortiClient VPN application, which is a small, free client. Some operating systems (Windows) also have built-in SSL VPN support.
Common causes: the user entered the wrong password (check caps lock), the authentication server is unreachable (check LDAP or RADIUS), the certificate on FortiGate has expired, or the IP pool for tunnel mode is full. Examine the FortiGate logs for specific error codes.
Split-tunnelling sends only corporate-bound traffic through the VPN; general internet traffic goes directly to the public internet. Full tunnel routes all traffic through the VPN, including internet traffic, so the company can inspect everything. Split-tunnelling saves bandwidth; full tunnel improves security compliance.
Yes. FortiGate supports SSL VPN connections from mobile devices via the FortiClient app for iOS and Android. The phone gets a virtual IP address and can access internal resources just like a laptop. Authentication works the same way, including two-factor.
Create a firewall policy that allows the user’s group to reach only that application server (destination IP and port). Then ensure no other policy permits broader access. In web mode, you can also limit the portal bookmarks to just that application.
You've finished SSL VPN and Remote Access. Continue through the NSE7 study guide to build a complete picture of the exam.
Done with this chapter?