# Remote Access VPNs (SSL and IPsec)

> Chapter 10 of the Courseiva FORTINET-NSE4 curriculum — https://courseiva.com/learn/fortinet-nse4/remote-access-vpns-ssl-and-ipsec

**Official objective:** 5.2 — Configure SSL VPN and client-based IPsec VPN for remote users, including portal settings and authentication.

## Introduction

If you can't securely connect a remote employee to the company network, your entire organisation is an open door for attackers, and your NSE4 exam will be a guaranteed fail. Remote Access VPNs solve the problem of letting a person in a coffee shop access internal files as if they were sitting at their desk, without the coffee shop or the internet being able to snoop. For the exam, you must understand the two main ways to build this secure connection: one that feels like a dedicated app (IPsec client) and one that feels like a website (SSL VPN).

## The Secure Courier Service Analogy

You are sending 47 identical, sealed diaries from a locked filing cabinet in your home office to a secure vault in a bank. You have two choices for how to deliver them.

Option 1 is like using a fleet of armoured trucks. Each truck (an IPsec VPN tunnel) is specifically designed to carry exactly this type of cargo. Before the first diary even leaves, you and the bank spend a day agreeing on a precise route, a secret handshake between the drivers, and a specific encryption code for the lock on the truck. Every single diary, from the first to the forty-seventh, is loaded onto one of these pre-agreed trucks. The bank knows exactly which truck is coming, what route it will take, and how to open it. Delivery is efficient and secure, but setting it up is a huge upfront project.

Option 2 is simpler. Instead of dedicated armoured trucks, you use the regular postal service, but with a special twist. You put each diary into a tamper-proof, encrypted box that can only be opened by the bank. The address on the box is just the bank's general public address (like a web server). For each diary you want to send, you request a temporary, secure, digital notary stamp (an SSL/TLS handshake) to authenticate the box. The postman doesn't know the box's code, but he verifies the notary stamp and delivers it to the bank's public loading dock. This is like an SSL VPN — it uses the existing public infrastructure (the web) and creates a secure, encrypted ‘dock’ (the portal) for each individual diary as needed. No pre-agreed fleet of trucks is required. The bank can handle diaries from many different people, all using different stamp protocols, through the same loading dock.

## Core explanation

A Remote Access VPN (Virtual Private Network) is a technology that creates a secure, encrypted tunnel between a remote user's device (like a laptop or phone) and a company's internal network over the public internet. It effectively extends the private company network to the user, no matter where they are. Without a VPN, any data sent over public Wi-Fi is like shouting a secret across a crowded room—anyone with basic tools can listen. With a VPN, that data is turned into indecipherable code for anyone except the intended recipient.

For the NSE4 exam, you need to master two distinct types: SSL VPN and client-based IPsec VPN. They achieve the same goal (secure remote access) but work in fundamentally different ways, which dictates when you would use each one.

**SSL VPN (Secure Sockets Layer Virtual Private Network)**

Think of SSL as the 'on-demand website' approach. It uses the same technology that secures your online banking (HTTPS). A user opens a standard web browser and navigates to a specific URL for their company's FortiGate firewall. This FortiGate acts as the VPN gateway. The browser and the FortiGate perform an SSL/TLS handshake to establish a secure session. Once authenticated—usually with a username and password, often combined with a one-time code from an authenticator app (multi-factor authentication, or MFA)—the user is presented with a web portal.

This portal is a web page that gives access to specific internal resources. It might show links to internal file shares, web applications (like an internal ticketing system), or Remote Desktop Protocol (RDP) shortcuts to specific desktops. Crucially, the user does not install a specialised piece of software (a VPN client). The web browser IS the client. This makes SSL VPNs incredibly easy to deploy to a large number of users, especially on devices the company does not fully control (BYOD, or Bring Your Own Device). The FortiGate's SSL VPN functionality is configured under the 'SSL-VPN' menu in the FortiOS interface, where you define the portal, the authentication methods, and the list of resources available to the remote user.

**Client-based IPsec VPN (Internet Protocol Security Virtual Private Network)**

This is the 'dedicated app' approach. IPsec is a suite of protocols that works at the network layer (Layer 3) of the OSI model. It encrypts the entire IP packet that any application sends. To use it, a user must first install a specific software application — a VPN client — on their device. The most common example for Fortinet is the FortiClient application. The user opens FortiClient, enters the destination address of the FortiGate, and clicks 'Connect'.

The FortiClient and the FortiGate then negotiate a secure connection. This process involves two main phases, defined in the IPsec standard:

- Phase 1: Establishes a secure channel for management traffic. The two devices agree on encryption algorithms (like AES-256), hashing algorithms (like SHA-256), and perform an authentication handshake. This creates an Internet Key Exchange (IKE) Security Association (SA). Think of it as the two devices shaking hands and agreeing on a secret language to discuss the terms of the actual tunnel.

- Phase 2: Within that secure management channel, they negotiate the actual tunnel for your data. They create an IPsec Security Association (SA) that defines exactly how your traffic will be encrypted and delivered. Once both phases are complete, a secure tunnel exists between FortiClient and the FortiGate. Now, when the user opens any application—email, a file browser, a database tool—all traffic destined for the internal company network is automatically encrypted by FortiClient and sent through this tunnel. The user doesn't see a portal; their computer behaves as if it is plugged directly into the office network.

The configuration for IPsec VPN on the FortiGate is done under the 'VPN' menu, in the 'IPsec Tunnels' section. You define the Phase 1 parameters (the authentication method, encryption settings, and the remote peer) and Phase 2 parameters (which networks are allowed through the tunnel, and encryption settings for data).

**Key Differences for NSE4**
- **Software Requirement:** SSL VPN requires only a browser. IPsec VPN requires a dedicated client (e.g., FortiClient).
- **Resource Access:** SSL VPN typically grants access to specific applications or websites via a portal. IPsec VPN grants full network-layer access, making the remote device a logical part of the local network.
- **Use Cases:** SSL VPN is excellent for providing access to a few internal web apps for many casual users (e.g., contractors accessing a timesheet portal). IPsec VPN is better for power users who need to run a variety of desktop applications that require direct network access (e.g., an engineer connecting to a database server using a specialised client).
- **Authentication:** Both support local password databases, LDAP (Lightweight Directory Access Protocol, a centralised user directory like Microsoft Entra ID), and RADIUS. SSL VPN portals can be configured to show only after a successful login, while IPsec VPN authentication happens as part of the Phase 1 negotiation.

**How FortiGate Authenticates Users**
FortiGate can authenticate users in several ways:

- **Local Database:** Usernames and passwords are stored directly on the FortiGate. Simple but not scalable for large organisations.
- **LDAP / Microsoft Entra ID:** The FortiGate talks to a central directory server. The user enters their standard corporate credentials, and the FortiGate asks the directory server if the password is correct. This is the most common enterprise method.
- **RADIUS (Remote Authentication Dial-In User Service):** The FortiGate forwards authentication requests to a separate server that can integrate with various backends (like Microsoft Entra ID with MFA). This is used when you need to enforce a second factor of authentication (like a code from a phone app).
- **Certificate-based Authentication:** Both the client and server have digital certificates. No password is typed; the devices prove their identity using cryptographic keys. Very secure but more complex to deploy.

The exam often tests the combination of these methods, such as 'LDAP for password validation and RADIUS for MFA'.

## Real-world context

Let's walk through a realistic scenario at a mid-sized company called 'Pinnacle Consulting'. Pinnacle has 200 employees, all using laptops. The IT manager, Priya, needs to allow employees to work from home. She decides to use a FortiGate firewall at the main office.

**Step 1: The Requirement Meeting**
Priya talks to two distinct groups. The sales team just needs access to a web-based CRM (Customer Relationship Management) system and an internal SharePoint site. The software development team needs full network access to run their code editors, connect to a Git server, and access databases. Based on this, Priya decides to use both VPN types.

**Step 2: Configuring the SSL VPN**
For the sales team, Priya configures an SSL VPN on the FortiGate. She creates an SSL-VPN portal named 'Sales-Portal'. She sets the portal type to 'web-only' and manually lists the resources:
- URL 'https://crm.pinnacle.internal'
- URL 'https://sharepoint.pinnacle.internal'
She configures authentication to use the company's Microsoft Entra ID (via LDAP) for usernames and a RADIUS server for MFA (a one-time passcode from an authenticator app). Users get an email with the FortiGate's public URL (e.g., 'vpn.pinnacle.com') and their credentials.

**Step 3: How a Sales Rep Connects**
A sales rep, James, opens Chrome on his personal laptop. He types 'https://vpn.pinnacle.com' into the address bar. The browser shows a warning about a certificate. He checks the certificate's fingerprint with the company policy, confirms it is valid, and proceeds. He enters his username and password (his Microsoft Entra ID credentials). The FortiGate checks this against the LDAP server. It then prompts him for a 6-digit code from his phone. He enters it, and the FortiGate verifies this with the RADIUS server. He is now shown a clean web portal with two links: 'CRM' and 'SharePoint'. He clicks 'CRM', and FortiGate proxies the connection, securely delivering the CRM web page to his browser. He never sees the internal IP addresses of the CRM server.

**Step 4: Configuring the IPsec VPN**
For the development team, Priya configures an IPsec VPN. She chooses 'FortiClient' as the client type. In the IPsec Phase 1 settings, she selects 'peer type' as 'dialup' (meaning many clients will connect). She selects a strong pre-shared key (a password shared between the FortiGate and all clients) and sets the encryption to AES256. In Phase 2, she specifies that the local network is '192.168.1.0/24' (the office subnet) and the remote network is '0.0.0.0/0' (meaning the clients can be anywhere). She then creates a user group for the developers and assigns them permission to use this IPsec tunnel. She distributes the pre-shared key and the FortiClient installer.

**Step 5: How a Developer Connects**
A developer, Anika, installs FortiClient on her work laptop. She opens it, clicks 'Add a new VPN connection', and enters the IP address 'vpn.pinnacle.com'. She selects 'IPsec VPN' as the type and enters the pre-shared key. She clicks 'Connect'. FortiClient and the FortiGate negotiate the Phase 1 and Phase 2 SAs. Once connected, FortiClient shows a green 'Connected' status. Anika now opens her code editor and tries to connect to the internal Git server at IP '192.168.1.50'. FortiClient intercepts this traffic, encrypts it, and sends it through the tunnel to the FortiGate, which decrypts it and forwards it to the Git server. The connection works seamlessly. At the office, the network administrator can see in the FortiGate logs that 'anika.pinnacle.com' is connected via IPsec tunnel 'dev-vpn'.

**Troubleshooting**
Later, James from sales reports he can't connect. Priya checks the FortiGate logs. She sees a failed SSL VPN authentication attempt from James's IP address. The log says 'authentication failed - invalid credentials'. Priya asks James to check his password. He realises his Caps Lock was on. The next day, a developer reports that FortiClient connects but he can't reach any internal server. Priya checks the IPsec Phase 2 settings and realises she forgot to add the local network subnet. She adds it, and the issue is resolved.

## Exam focus

The NSE4 exam (Fortinet NSE 4 - FortiOS 7.2) will test your understanding of Remote Access VPNs heavily, especially the practical differences between SSL and IPsec. Expect at least 5-8 questions on this topic. The exam is not about memorising theory; it is about applying your knowledge to a scenario.

**Question Types You Will See**

- **Scenario-based multiple choice:** You are given a description of a company's needs (e.g., '200 users need access to a single web app, no software can be installed'). You choose the correct VPN type.
- **Click-on-a-diagram:** You see a diagram of FortiGate dashboard components. You must click the correct menu path (e.g., 'Where do you configure the SSL-VPN portal?').
- **Fill-in-the-blank:** You are given a sentence with a key term missing. Example: 'In an IPsec VPN, the two devices first establish an _____ in Phase 1.'
- **Multiple answer:** Which three are valid authentication methods for an SSL VPN on FortiGate? (Choices: LDAP, RADIUS, local database, IPsec Phase 1).

**Traps the Exam Sets**

- **The 'No Client' Trap:** The exam loves to present a scenario where the user is on a company laptop but the question specifies 'no software can be installed'. Many candidates incorrectly choose IPsec, but the correct answer is SSL VPN because it only needs a browser. IPsec always needs a client.
- **The 'Application Access' Trap:** If a scenario says 'users need to run custom desktop applications that use non-standard ports', the correct answer is IPsec, not SSL VPN. SSL VPN typically only proxies web traffic. The exam will try to make you think SSL can handle everything.
- **The 'Authentication Method' Trap:** The exam may present a scenario where a company uses a single password. It asks 'which authentication method is missing for secure remote access?'. The correct answer is multi-factor authentication (MFA), and you must know that MFA is typically added via a RADIUS server, not via LDAP.
- **The 'Portal vs Tunnel' Trap:** Questions will ask about 'portal settings'. This is an SSL VPN concept. Do not confuse it with IPsec tunnel settings. The exam may describe a portal that lists applications and ask you what type of VPN this describes. Answer: SSL VPN.
- **The 'Split Tunneling' Trap:** The exam may ask about how to configure the tunnel so that only corporate traffic goes through the VPN, while internet traffic (e.g., YouTube) goes directly out the user's home connection. This is called 'split tunnelling'. The exam wants you to know it is configured differently in SSL (usually enabled by default for web-only mode) vs IPsec (needs explicit route configuration).

**Key Definitions to Memorise**

- **SSL-VPN:** A VPN that uses the web browser and the HTTPS protocol to provide secure access to applications. No client software required.
- **IPsec VPN:** A VPN that creates a secure network layer tunnel. Requires a dedicated client application (like FortiClient).
- **Portal:** The web page presented to an SSL VPN user after authentication. Contains links to resources.
- **Pre-shared Key (PSK):** A secret string of characters used to authenticate an IPsec VPN peer. Both sides must know it.
- **Phase 1 (IKE):** The first exchange in IPsec that creates a secure management channel. Can use Main Mode or Aggressive Mode.
- **Phase 2 (IPsec SA):** The second exchange that creates the actual data tunnel.
- **LDAP:** A protocol for accessing a centralised directory of usernames and passwords (e.g., Microsoft Entra ID, OpenLDAP).
- **RADIUS:** A protocol for centralised authentication, authorisation, and accounting (AAA), often used to enforce MFA.
- **Multi-Factor Authentication (MFA):** A security method that requires more than one piece of evidence to log in (e.g., password + code from a phone).
- **Authentication Server:** A server (like a FortiAuthenticator or a third-party RADIUS server) that validates user credentials.

**What the Exam Will NOT Ask**

- The exam will not ask you to write the exact command-line configuration for IPsec. It will present the GUI configuration options and ask you to identify the correct one.
- The exam will not ask you to memorise obscure encryption algorithm details. You need to know the names (AES, 3DES) and that AES is stronger, but not the bit-level differences.
- The exam will not ask about legacy protocols like PPTP. Focus on SSL, IPsec, and L2TP (though L2TP is less common now).

## Step by step

1. **Define Access Requirements** — Identify whether users need access to specific web applications (choose SSL VPN) or full network access for desktop apps (choose IPsec VPN). This step determines which VPN type to configure on the FortiGate.
2. **Configure Authentication Method** — On the FortiGate, navigate to User & Authentication > LDAP (or RADIUS) to set up the external authentication server. For SSL VPN, the portal will prompt for credentials. For IPsec VPN, the client will send these credentials during Phase 1 negotiation. Always consider enabling MFA via RADIUS.
3. **Configure SSL VPN Portal (if using SSL)** — Go to VPN > SSL-VPN Settings and enable SSL-VPN. Set the listening interface (usually WAN) and port. Then, under VPN > SSL-VPN Portals, create a new portal. Define the resources (URLs, bookmarks, or full tunnel access) that authenticated users will see. Assign this portal to a user group.
4. **Configure IPsec VPN (if using IPsec)** — Go to VPN > IPsec Tunnels and create a new tunnel. For remote access, set peer type to 'Dialup'. In Phase 1, configure authentication (pre-shared key or certificate), encryption (e.g., AES256), and the local interface. In Phase 2, define the local network subnet to be accessed (e.g., 192.168.1.0/24) and the encryption for data. Apply the configuration.
5. **Assign User Permissions and Distribute Client** — Create a user group (e.g., 'SSL-VPN-Users' or 'IPsec-Users') and assign the appropriate firewall policy that allows the VPN traffic. For IPsec, ensure FortiClient is installed on user devices and configured with the correct pre-shared key and gateway IP. For SSL VPN, share the portal URL and credentials with users.
6. **Test the Connection and Verify Logs** — Have a test user connect. For SSL VPN, open a browser, navigate to the portal URL, authenticate, and verify resource access. For IPsec, open FortiClient, connect, and verify that internal resources are reachable (e.g., ping a server). Check the FortiGate logs under Log & Report > VPN Events to see successful connections and troubleshoot errors.

## Comparisons

### SSL VPN vs IPsec VPN

**SSL VPN:**
- Operates at the application layer of the OSI model, using HTTPS.
- No dedicated client software needed; works in any modern browser.
- Typically provides application-layer access via a web portal; user cannot directly access arbitrary network ports.

**IPsec VPN:**
- Operates at the network layer (Layer 3), encrypting entire IP packets.
- Requires a dedicated client application, such as FortiClient.
- Provides full network-layer access; the remote device behaves as if it is on the local LAN.

### Phase 1 (IKE) of IPsec vs Phase 2 (IPsec SA) of IPsec

**Phase 1 (IKE) of IPsec:**
- Establishes a secure management channel (IKE SA) for negotiating the data tunnel.
- Uses Diffie-Hellman key exchange to create a shared secret.
- Authenticates the remote peer using a pre-shared key or certificate.

**Phase 2 (IPsec SA) of IPsec:**
- Establishes the actual data tunnel (IPsec SA) for encrypting user traffic.
- Uses the keys from Phase 1 to negotiate encryption algorithms for data.
- Defines which network subnets are allowed through the tunnel (e.g., local network 192.168.1.0/24).

### LDAP Authentication vs RADIUS Authentication

**LDAP Authentication:**
- Used to verify a username and password against a central directory.
- Does not support multi-factor authentication (MFA) natively.
- Commonly used for simple password validation against Microsoft Entra ID.

**RADIUS Authentication:**
- A protocol for centralised authentication, authorisation, and accounting (AAA).
- Supports MFA by forwarding requests to an MFA server (e.g., FortiAuthenticator).
- Usually used to add a second authentication layer, such as a one-time passcode from a phone.

## Diagram

_A comparison of the two remote access VPN methods: SSL VPN using a browser and portal, versus IPsec VPN using a dedicated client and a two-phase tunnel._

```mermaid
flowchart TD
    A[Remote User] --> B{Connection Method}
    B -->|SSL VPN| C[Browser opens portal URL]
    C --> D[FortiGate presents login page]
    D --> E[User authenticates (LDAP/RADIUS)]
    E --> F[User sees web portal with apps]
    F --> G[User clicks app link]
    G --> H[FortiGate proxies traffic to internal server]
    B -->|IPsec VPN| I[User opens FortiClient]
    I --> J[FortiClient initiates Phase 1 (IKE)]
    J --> K[FortiGate and client authenticate using PSK]
    K --> L[Phase 2 establishes data tunnel]
    L --> M[Client gets virtual IP on internal network]
    M --> N[User runs any app, traffic auto-encrypted]
    N --> O[App reaches internal server via tunnel]
    H --> P[Internal Network]
    O --> P
```

## Common misconceptions

- **Misconception:** SSL VPN is always less secure than IPsec VPN. **Reality:** Both can be equally secure when properly configured with strong encryption (e.g., AES-256) and multi-factor authentication. The security difference depends more on configuration and policies than on the protocol itself. SSL is not inherently 'weaker'. (People hear 'SSL' and think of old, broken versions (SSL 3.0). Modern SSL VPNs use TLS (Transport Layer Security), which is the same technology securing online banking. IPsec sounds more 'technical' and military-grade, so beginners assume it is innately stronger.)
- **Misconception:** An IPsec VPN does not require any user interaction after the client is installed. **Reality:** While the connection can be automated, the user still usually needs to authenticate (enter a username and password or a certificate) each time they connect. The client handles the technical negotiation, but the user must prove who they are. Only auto-connect with certificate-based authentication removes this step. (Beginners see demos where a user just clicks one button and are connected. They miss the authentication step because it is often a pop-up box they imagine is 'part of the client'. The exam will test whether you know that authentication is a separate mandatory step.)
- **Misconception:** SSL VPN can give full network-layer access to any application, just like IPsec. **Reality:** Standard SSL VPN (web-only mode or with a thin client) typically only provides access to applications that can be proxied through a web browser. For full network-layer access (where any TCP/UDP application works), you need a full tunnel SSL VPN (which requires installing a small client component) or an IPsec VPN. The exam tests this distinction. (Marketing materials for SSL VPNs often boast 'any application access' using a web portal, but this usually refers to specific pre-configured applications, not arbitrary network connections. Beginners conflate 'any application' with 'any network protocol'.)
- **Misconception:** IPsec VPN Phase 1 and Phase 2 are the same thing. **Reality:** They are completely different. Phase 1 establishes an insecure management channel (IKE SA) to negotiate how the data tunnel will be secured. Phase 2 establishes the actual data tunnel (IPsec SA) using the parameters agreed in Phase 1. Mixing them up is a common exam trap. (Both phases sound like 'setting up a secure connection'. Beginners hear 'two phases' and assume they are redundant steps for the same goal. The exam exploits this by presenting a configuration step and asking 'in which Phase would you configure this?'.)
- **Misconception:** You can use LDAP to enforce multi-factor authentication directly. **Reality:** LDAP is a directory protocol that simply verifies a username and password. It does not support push notifications, one-time passcodes, or other MFA mechanisms. To add MFA, you must use a separate protocol (like RADIUS) that sends the authentication request to a server (like a FortiAuthenticator or an MFA gateway) that can handle the second factor. (Beginners see 'LDAP' and 'RADIUS' listed as authentication methods and think they are interchangeable. They are not. LDAP is for simple password checks; RADIUS is for advanced authentication including MFA. The exam will test this specific distinction.)

## Key takeaways

- SSL VPN does not require a dedicated client application because it runs inside a standard web browser using HTTPS.
- IPsec VPN always requires a dedicated client (like FortiClient) to create a secure network-layer tunnel.
- The FortiGate SSL VPN portal is configured to grant access only to specific applications or URLs, not the entire network.
- IPsec VPN provides full network-layer access, allowing any application on the remote device to reach internal networks as if it were local.
- Authentication for both VPN types can use local database, LDAP (for passwords), or RADIUS (for advanced features like MFA).
- The IPsec negotiation consists of two distinct phases: Phase 1 (IKE, management channel) and Phase 2 (IPsec SA, data tunnel).
- Multi-factor authentication (MFA) for FortiGate VPN requires a RADIUS server, not LDAP, to handle the second authentication factor.
- A common exam trap is choosing IPsec when the scenario says 'no software can be installed on the user device' — the correct answer is SSL VPN.
- SSL VPN can be configured in 'web-only' mode (portal) or 'full tunnel' mode (which still requires a small client plugin).
- Split tunnelling means only corporate traffic goes through the VPN; all other traffic goes directly to the internet to save bandwidth.
- The FortiGate can act as both the VPN gateway and the authentication proxy, or it can delegate authentication to an external server.
- For exam questions about 'portal settings', the answer will always relate to SSL VPN, not IPsec.

## FAQ

**Do I need to install FortiClient for an SSL VPN?**

No. SSL VPN runs entirely in a web browser. FortiClient is a separate application used for IPsec VPN and for endpoint security features. You only need FortiClient for IPsec-based remote access.

**Can I use both SSL VPN and IPsec VPN on the same FortiGate?**

Yes. You can configure both types on the same FortiGate. Different user groups can be assigned to different VPN types based on their access needs. The FortiGate can handle simultaneous SSL and IPsec connections.

**What is a pre-shared key and is it safe?**

A pre-shared key (PSK) is a secret password shared between the FortiGate and all IPsec VPN clients. It is used in Phase 1 authentication. It is safe if it is long and complex (e.g., 20+ random characters), but it should be changed regularly. A certificate-based authentication is more secure but more complex to set up.

**Does SSL VPN only work for web applications?**

Not strictly. A web-only SSL VPN portal only works for web applications that use HTTP/HTTPS. However, FortiGate offers a 'full tunnel' SSL VPN mode that requires a small client plugin, which can tunnel any IP-based application. For exam purposes, assume SSL VPN is best for web apps unless specified otherwise.

**What is the difference between LDAP and RADIUS for authentication?**

LDAP is used to look up and verify a username and password against a central directory like Microsoft Entra ID. RADIUS is a protocol that provides centralised authentication, authorisation, and accounting, and it can integrate with MFA systems. For simple password checks, use LDAP. For MFA, use RADIUS.

**Do I have to configure a firewall policy for VPN traffic?**

Yes. After enabling SSL VPN or IPsec VPN, you must create a firewall policy that allows traffic from the VPN interface (e.g., 'ssl.root' or 'ipsec_vpn') to the internal network. Without this policy, authenticated users will connect but have no access to resources.

## Check your understanding

1. **Which type of VPN requires no dedicated client software on the user's device, only a web browser?**

   Answer: SSL VPN. It uses the HTTPS protocol in a standard browser to provide secure remote access to applications via a portal.

2. **What are the two phases of IPsec VPN negotiation, and what does each one do?**

   Answer: Phase 1 (IKE) establishes a secure management channel between the devices. Phase 2 (IPsec SA) creates the actual data encryption tunnel within that management channel.

3. **A user needs to run a proprietary desktop application that connects to an internal database server. Which VPN type should you choose?**

   Answer: IPsec VPN, because it provides full network-layer access, allowing any application to communicate with internal servers as if the device were on the local network.

4. **Your organisation wants to enforce multi-factor authentication for all VPN users. Which authentication protocol should you integrate with the FortiGate?**

   Answer: RADIUS. RADIUS can forward authentication requests to an MFA server (like FortiAuthenticator) to handle the second factor. LDAP only validates passwords.

5. **What is the primary function of an SSL VPN portal on FortiGate?**

   Answer: The portal presents authenticated users with a web page containing links or bookmarks to specific internal applications, allowing the FortiGate to proxy traffic to those resources.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/fortinet-nse4/remote-access-vpns-ssl-and-ipsec