SSL VPN Tunnel Mode: No Access to Internal Resources
An administrator has configured an SSL VPN. Remote users can connect and authenticate but cannot access internal resources. The SSL VPN policy allows all traffic from the SSL VPN interface to internal servers. What is the MOST likely missing configuration?
Quick Answer
The answer is a missing or misconfigured firewall policy between the SSL VPN interface and the internal network. When remote users connect in SSL VPN tunnel mode and can authenticate but have no access to internal resources, the most common cause is that while the SSL VPN policy itself permits traffic, the separate firewall policy governing traffic flow from the SSL VPN interface to the internal network has not been created or is incorrectly ordered. On FortiGate, tunnel mode creates a virtual interface, and all traffic routed through that tunnel must be explicitly allowed by a firewall policy—split-tunneling settings only control which destinations use the tunnel, not whether the traffic is permitted. This scenario is a classic trap on the Fortinet NSE 4 exam, testing your understanding that SSL VPN policies and firewall policies are distinct layers; many candidates mistakenly focus on authentication or routing instead. Remember the memory tip: “Tunnel in, firewall out”—the tunnel gets you in, but the firewall policy lets you out to internal resources.
⚠ Common exam trap
Many exam-takers confuse the SSL VPN policy (which controls authentication and portal access) with the firewall policy (which controls traffic forwarding), assuming the SSL VPN policy alone is sufficient to allow traffic to internal resources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The firewall policy allowing traffic from SSL VPN interface to internal network is missing
The most likely missing configuration is a firewall policy that explicitly permits traffic from the SSL VPN interface (e.g., ssl.root) to the internal network. Even with an SSL VPN policy allowing traffic, FortiGate requires a separate firewall policy to control and allow the decrypted traffic to reach internal resources. Without this policy, packets are dropped by the implicit deny rule.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The remote user's client does not support split tunneling
Why it's wrong here
Split tunneling is configured on the FortiGate, not the client.
- ✓
The firewall policy allowing traffic from SSL VPN interface to internal network is missing
Why this is correct
Even with SSL VPN configured, traffic must be allowed by a firewall policy from the SSL VPN interface to the destination.
- ✗
The authentication timeout is too short
Why it's wrong here
Timeout would cause disconnection, not inability to access resources.
- ✗
The SSL VPN portal does not have the correct bookmark configured
Why it's wrong here
Bookmarks are for web mode, not tunnel mode.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator is troubleshooting an SSL VPN connection. Users can connect but cannot access internal resources. Which TWO commands would help diagnose the issue?
medium- ✓ A.get router info routing-table
- ✓ B.diagnose vpn ssl list
- C.diagnose vpn ike status
- D.execute ping 8.8.8.8
- E.diagnose debug application dnsproxy
Why A: The 'get router info routing-table' command displays the FortiGate's routing table, which is essential for verifying that the FortiGate has a route to the internal resources the SSL VPN users are trying to access. If the route is missing or incorrect, traffic from the SSL VPN tunnel will not be forwarded to the internal network. Option B is correct because 'diagnose vpn ssl list' shows active SSL VPN sessions, including the assigned virtual IP (VIP) and tunnel interface, which helps confirm that the user is properly connected and has received an IP address from the correct address pool.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.