Why Can't I Ping or RDP Over SSL VPN Web Mode? Change to Tunnel Mode
A client connects to a FortiGate SSL VPN in web mode. The user can access internal web applications but cannot ping or RDP to servers. The administrator wants to allow these services. What must be changed?
Quick Answer
The answer is to change the SSL VPN type from web mode to tunnel mode. Web mode functions as a clientless portal that only proxies HTTP/HTTPS traffic to internal web applications, which is why you cannot ping or RDP over SSL VPN web mode to access internal resources—those protocols require a full network-layer connection. On the Fortinet NSE 4 Network Security Professional exam, this scenario tests your understanding of SSL VPN deployment modes and their traffic-handling capabilities; a common trap is assuming web mode supports all protocols simply because it provides application access. Tunnel mode, by contrast, creates a virtual interface on the client, routes all IP traffic, and allows non-web services like ICMP and RDP to reach internal servers. Remember the memory tip: “Web mode is for web only; tunnel mode tunnels everything.”
⚠ Common exam trap
Many exam-takers assume adding a firewall policy or enabling split tunneling will magically allow non-web traffic in web mode, not realizing that web mode fundamentally lacks the Layer 3 virtual interface required to route protocols other than HTTP/HTTPS.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Change the SSL VPN type from web mode to tunnel mode
Web mode SSL VPN only provides application-layer access through a web portal, typically using HTTP/HTTPS. It does not create a virtual network interface on the client, so lower-layer protocols like ICMP (ping) and RDP (TCP/3389) cannot be routed through the VPN. To support these services, the VPN must operate in tunnel mode, which assigns a virtual IP to the client and creates a full Layer 3 tunnel, allowing all IP-based traffic to traverse the FortiGate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable split tunneling on the SSL VPN portal
Why it's wrong here
Split tunneling controls which traffic goes through the VPN, but web mode still only supports web applications.
- ✓
Change the SSL VPN type from web mode to tunnel mode
Why this is correct
Tunnel mode supports all IP traffic, not just web, by creating a virtual network interface.
- ✗
Add the server IP addresses to the portal's bookmarks
Why it's wrong here
Bookmarks only provide links for web-based access, not RDP.
- ✗
Configure a firewall policy allowing the client's IP to the servers
Why it's wrong here
The policy may already exist, but web mode cannot carry non-web traffic.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
3 more ways this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are troubleshooting an SSL VPN connection. The user can reach the SSL VPN portal but cannot ping or access any internal resources. The portal shows the user as authenticated. Which configuration is MOST likely missing?
hard- ✓ A.There is no firewall policy allowing traffic from ssl.root to the internal network
- B.Client certificate authentication is required but not provided
- C.Split tunneling is disabled
- D.The SSL VPN realm is not configured correctly
Why A: The user can authenticate and reach the SSL VPN portal, which indicates that the SSL VPN tunnel itself is established and authentication is successful. However, the inability to ping or access internal resources despite being authenticated points to a missing firewall policy that explicitly permits traffic from the SSL VPN interface (ssl.root) to the internal network. Without this policy, the FortiGate will drop all traffic from the SSL VPN tunnel, even though the user is logged in.
Variation 2. A remote user connects via SSL VPN web mode but cannot access internal resources. The SSL VPN portal is configured with the default settings. What is the most likely reason?
medium- A.The user must be authenticated via LDAP
- B.The user has not installed the FortiClient VPN plugin
- ✓ C.Web mode only allows access to specific bookmarks configured in the portal
- D.The SSL VPN policy is missing a security profile
Why C: In SSL VPN web mode, the FortiGate acts as a proxy, granting access only to pre-configured bookmarks (URLs or applications) defined in the SSL VPN portal. Default portal settings do not include any bookmarks, so even after successful authentication, the user sees an empty portal and cannot reach internal resources. This is by design, as web mode does not provide full network-layer access like tunnel mode does.
Variation 3. Which mode of SSL VPN provides full network-layer access to the remote network, allowing any application to function as if the client is directly connected?
easy- ✓ A.Tunnel mode
- B.Web mode
- C.Split tunneling mode
- D.Clientless mode
Why A: Tunnel mode is correct because it creates a virtual network interface on the client that obtains an IP address from the FortiGate's SSL VPN address pool, encapsulating all IP traffic within SSL/TLS packets. This provides full network-layer (Layer 3) access, allowing any application—including those using non-HTTP protocols like SSH, RDP, or custom TCP/UDP services—to function as if the client were directly connected to the remote network.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.