I'll be referring to this Tunnel as VPN-RA-Test. Give it whatever name you need!
### 1. Creating a VPN Tunnel 1. Go to VPN - IPsec Tunnels 2. Click Create New and select IPsec Tunnel - Template Type: Custom - Name: VPN-RA #### 1.1. Network Settings - 1. Set *IP Version* to **IPv4** 2. Set *Remote Gateway* to **Dialup User** - Interface: Your WAN Interface 3. Disable *Local Gateway* 4. Enable *Mode Config* 5. Set *Client Address Range* manually or Assign Range Address Object 6. Set *Subnet Mask* `255.255.255.255` to prevent Inter-Device Communication inside the Tunnel or specify explicitly 7. Set your preferred DNS Server. 8. Enable *Enable IPv4 Split Tunnel* - Select your Address Object representing the Networks that should be accessable 9. Disable *IPv6 Mode Config* - *Client Address Range* 10. Set *NAT Traversal* to **Enable** 11. Set *Dead Peer Detection* to **On Idle** [](https://kb.oliver-karger.de/uploads/images/gallery/2025-09/MfSimage.png) #### 1.2. Authentication 1. Set *Method* to **Pre-shared Key** 2. Write your PSK to the *Pre-shared Key* Input Field 3. Set *IKE* - *Version* to **1** 4. Set IKE - *Mode* to **Agressive** 5. Set *Peer Options* - *Accept Types* to **Any Peer ID** [](https://kb.oliver-karger.de/uploads/images/gallery/2025-09/v2Bimage.png)You can set a Peer ID here to differentiate different Tunnels that might share Settings and/or PSKs
#### 1.3. Phase 1 ProposalRemove all existing Phase 1 Proposals beforehand by clicking the **X** Button the right side
1. Add the following Proposals - Encryption: **AES256**, Authentication: **SHA256** - Encryption: **AES256**, Authentication: **SHA1** 2. Check *Diffie-Hellmann Groups* **14**, **19**, **20** 3. Set *Key Lifetime (seconds)* to **28800** [](https://kb.oliver-karger.de/uploads/images/gallery/2025-09/PIVimage.png) #### 1.4. XAuth 1. Set *Type* to **Auto Server** 2. Set *User Group* to **Inherit from policy** [](https://kb.oliver-karger.de/uploads/images/gallery/2025-09/h03image.png) #### 1.5. Phase 2 SelectorsThere should only be one Phase 2 Selector pre-existing with the Name of the Tunnel you specified
##### 1.5.1 Edit Default Phase 2 Selector 1. Click on the Pen Icon at the Right Side of the Row to Edit 2. Expand the Advanced Menu by clicking on *Advanced* 1. Set *Name* to **VPN-RA-P2** 2. Set *Local Address* to Type **Subnet** and Value `0.0.0.0/0` 3. Set *Remote Address* to Type **Subnet** and Value `0.0.0.0/0` 4. Delete all existing Phase 2 Proposals 5. Add the following Phase 2 Proposals (same as with Phase 1) - Encryption: **AES256**, Authentication: **SHA256** - Encryption: **AES256**, Authentication: **SHA1** 6. Enable *Enable Replay Detection* 7. Enable *Enable Perfect Forward Secrecy (PFS)* 8. Check *Diffie-Hellmann Groups* **14**, **19**, **20** 9. Enable *Local Port* 10. Enable *Remote Port* 11. Enable *Protocol* 12. Set *Key Lifetime* to **Seconds** and set `3600` [](https://kb.oliver-karger.de/uploads/images/gallery/2025-09/yHximage.png) ### 2. Create Policies For a Policy-based IPsec VPN you need Policies that allow both the Address Range of the Clients and the Users to access the Networks you need. Depending on the Networks you specified, you need Policies from WAN->LAN and maybe WAN->OtherLAN. #### 2.1 Example Policy This is an Example Policy from WAN to LAN I use Address Objects here that i also specified in the Tunnel Configuration.Note: You cannot specifiy Subnet Address Objects in the Tunnel Configuration, only IP Ranges. But if the Subnet contains the IP Range, this works fine. Example: Range is 192.168.10.100 - 192.168.10.200 so a Subnet of 192.168.10.0/24 would work just fine
[](https://kb.oliver-karger.de/uploads/images/gallery/2025-09/kF5image.png) Here my Policies allows Traffic from the VPN Tunnel Interfaces (created when creating the Tunnel) to the LAN Interface. As here, Authentication is Policy-based, for the Source we also need the User/User Groups. Destination is a Group i created that is the same i used for the *Split Tunneling* - *Accessable Networks* You can also specify a Schedule or Service if you want to.You need Policies in both Directions for them to work correctly!
# Virtual Server Reverse Proxy #### What will be done - Using a FortiGate to act as a Reverse Proxy, forwarding `domain.tld` to `ip:port` #### Prerequesits - Static IP - Port 443 (TCP) for HTTPS openIn this Example, Forgejo will be used as Application
### 1. Creating a Virtual Server 1. Go to Policy & Objects - Virtual Servers and Click Create New 2. Set a Name #### 1.2 Network Configuration 1. Set *Type* to **HTTPS** 2. Set *Interface* to your WAN Interface 3. Set *Virtual server IP* to your Public IP (or TN IP if behind a NAT Router) 4. Set *Virtual server port* to `443` 5. Set *Load balancing method* to **HTTP Host** 6. Set *Persistence* to **HTTP Cookie** 7. Enable *Preserve client IP* [](https://kb.oliver-karger.de/uploads/images/gallery/2025-09/gSgimage.png)You can add Health Checks for this Virtual Server here
#### 1.3 SSL Offloading As the FortiGate will be acting as Reverse Proxy in this Situation, SSL Encryption needs to be done at the Firewall. Select/Upload your SSL Certificate here and Set *Mode* to **Full** [](https://kb.oliver-karger.de/uploads/images/gallery/2025-09/qHZimage.png) #### 1.4 Real Servers For each public Domain, create a Real Server here Example: git.domain.tld 1. Click *Create New* 2. Set *IPv4 Address* to your internal Server IP Address 3. Set *Port* to your internal Server Port 4. Set *Max connections* to `0` for unlimited Connections or set a fixed limit 5. Set *HTTP host* to your public Domain 6. Set *Mode* to **Active** [](https://kb.oliver-karger.de/uploads/images/gallery/2025-09/mNFimage.png) ### 2. Creating Firewall Policy We need a Proxy-based Policy that allows WAN Access to the created Virtual ServerIf you can't select your Virtual Server here, switch to *Proxy-based* Inspection Mode first.
[](https://kb.oliver-karger.de/uploads/images/gallery/2025-09/Li8image.png) ### 3. Application Configuration Your Application needs to be able to accept Traffic to Port 80 with the specific Public Domain. As the FortiGate will handle SSL Encryption, you need to make sure your Application accepts plain HTTP without HTTP-to-HTTPS-Redirection # SSL-VPN on custom Interface This explains how to setup the SSL-VPN on a FortiGate (E-Series) on a Custom Interface for better Controls. This is done because per default, SSL-VPN Listens on the WAN Interface directly, therefor can not be controlled by any Policy. ### Create Loopback Interface [](https://kb.oliver-karger.de/uploads/images/gallery/2025-10/rpiimage.png) [](https://kb.oliver-karger.de/uploads/images/gallery/2025-10/XFDimage.png) [](https://kb.oliver-karger.de/uploads/images/gallery/2025-10/q1Kimage.png) ### Bind SSL-VPN to new Loopback Interface [](https://kb.oliver-karger.de/uploads/images/gallery/2025-10/C8yimage.png) [](https://kb.oliver-karger.de/uploads/images/gallery/2025-10/AQ0image.png) ### Redirect SSL-VPN Traffic We now need to make sure the SSL-VPN Traffic actually reaches the new SSL-VPN Interface. We will use a Virtual IP with Port Forwarding for that. [](https://kb.oliver-karger.de/uploads/images/gallery/2025-10/YLeimage.png) [](https://kb.oliver-karger.de/uploads/images/gallery/2025-10/9SAimage.png) [](https://kb.oliver-karger.de/uploads/images/gallery/2025-10/uGlimage.png) ### Allow Traffic to new Interface [](https://kb.oliver-karger.de/uploads/images/gallery/2025-10/exOimage.png) [](https://kb.oliver-karger.de/uploads/images/gallery/2025-10/tsvimage.png) [](https://kb.oliver-karger.de/uploads/images/gallery/2025-10/adOimage.png) # Setup of Public Captive Portal ### 1. Portal basic Settings ##### Configure Certificate and enable HTTPS ``` config user setting set auth-cert "certificate" set auth-secure-http enable end ``` ##### Set public FQDN / DNS Name ``` config firewall auth-portal set portal-addr "portal.company.com" end ``` ### 2. Configure public Port It is recommended to explicitly set a public Port ``` config system global set auth-https-port 45443 end ``` ### 3. Update Policies Simply add your Users/Groups to the Policies. # ASIC Offloading & VoIP Quality Issues ### **Problem Description** Real-time VoIP applications (Discord, Teams, Zoom) exhibit high latency (>200ms) and packet loss, forcing a fallback to low-quality TCP relays. Audio input appears "damped," robotic, or near-silent to other participants, despite sounding perfect in local monitoring or DAW software. ### Fix 1. **Disable Hardware Offloading:** Prevents the NPU from dropping fragmented UDP return traffic. 2. **Enable Fixed Port:** Forces the firewall to use the same internal source port for the external connection, allowing the upstream router to maintain the session.| Secure Protocol | IKEv2 VPN |
| Name | <Name> |
| Server Address | Public DNS Domain (same as localid in Tunnel Config) |
| Authentication Method | Pre-shared Key |
| Pre-shared Key Secret | PSK |
| EAP-AUTH | Enabled |
| Local ID | empty |
| Remote-ID | Public DNS Domain (same as localid in Tunnel Config) |
| Phase 1 Encryption | AES256 |
| Phase 1 Authentication | SHA256 |
| Phase 1 DH GRoup | 14 |
| Phase 1 Key Lifetime | 86400 |
| Phase 1 Encryption | AES256 |
| Phase 1 Authentication | SHA256 |
| Phase 1 DH GRoup | 14 |
| Phase 1 Key Lifetime | 43200 |
| DPD | enabled |
| PFS | enabled |
| Username | Client Username (User in FortiGate) |
This has been tested with Keycloak 26.X and FortiOS 7.6.6
Realm names in Keycloak are case-sensitive. Ensure all URLs referencing the realm name use the exact same casing (e.g. `MyRealm` not `myrealm`).
You need a separate Keycloak client for each FortiGate SSO use case. For example: one client for Admin SSO and one for User SSO (firewall policy authentication). This allows separate access restrictions per use case.
### Keycloak Setup The following steps apply to both the Admin SSO client and the User SSO client. Differences between the two are noted where applicable. #### Step 1: Create the Keycloak Client (basic) 1. Log into Keycloak and go to *Clients* 2. Create a new Client of Type *SAML* and set the Client ID: - **Admin SSO:** `http://Note the trailing slash — it must be present. The Client ID must be a byte-for-byte match of the Issuer value sent by FortiGate in its SAMLRequest.
3. Finish the Create Client wizard with default settings for now #### Step 2: Client Settings (advanced) - General Settings - Set a display name for *Name* - Optionally set a *Logo URI* to display a logo on the account console. For FortiGate clients the official Fortinet logo is available at: `https://upload.wikimedia.org/wikipedia/commons/6/62/Fortinet_logo.svg`The Logo URI is only shown in the Keycloak account console, not on the login page itself. To show a logo on the login page, a custom theme is required.
- Access settings - Set your FortiGate address as *Root URL* and *Home URL* - Set *Valid Redirect URIs*: - **Admin SSO:** `https://This works by creating a realm role, assigning it to a group, and then creating a custom authentication flow that denies access to users who do not have that role.
#### Step 1: Create a Realm Role 1. Go to *Realm roles → Create role* 2. Set a name for the role (e.g. `Firewall Admins` or `Firewall Users`) 3. Save #### Step 2: Assign the Role to a Group 1. Go to *Groups → your desired group → Role mapping* 2. Click *Assign role* 3. Select the role created in Step 1 and assign itAll members of the group will automatically inherit the role. If you use AD/LDAP federation, make sure group sync is configured so group memberships are reflected in Keycloak.
#### Step 3: Create a Custom Authentication Flow 1. Go to *Authentication → Flows* 2. Click on *Browser → Action → Duplicate* 3. Give it a descriptive name (e.g. `Browser - Firewall Admins`) and confirm 4. Open the duplicated flow 5. Click *Add sub-flow* at the top level: - *Name:* `Role Check` - *Requirement:* `Conditional` 6. Inside the *Role Check* sub-flow, click *Add condition*: - Select *Condition - User Role* - *Requirement:* `Condition` - Click the settings (pencil) icon and set: - *Role:* select the role created in Step 1 - *Negate:* `On` 7. Inside the *Role Check* sub-flow, click *Add step*: - Select *Deny Access* - *Requirement:* `Required`The Negate toggle is critical. With Negate On, the condition matches users who do **not** have the role, causing them to be denied. Without Negate, users **with** the role would be denied instead.
#### Step 4: Bind the Flow to the Client 1. Go to *Clients → your client → Advanced tab* 2. Scroll to *Authentication flow overrides* 3. Set *Browser flow* to your newly created flow 4. Save ### FortiGate Setup #### Preparation — Import Keycloak CertificateMake sure to download the certificate from your specific realm's metadata endpoint, not the master realm. Each realm has its own signing key.
1. Open `https://Users matching a firewall policy with this group will be prompted to authenticate via Keycloak SAML before traffic is allowed through.