Ssl Vpn Host Os Patch Check; Configuration Example - Fortinet FORTIOS V3.0 MR7 User Manual

SSL VPN host OS patch check

SSL VPN host OS patch check
54
SSLVPN Client OS Patch Check feature allows a client with a specific OS patch to
access SSL VPN services. The host check only works on Windows platforms.
This means that MacOS/Linux users can always logon (assuming they have the
correct user name and password) as the patch check is not applied to them.
Options defined in the SSL VPN user group settings support this function (CLI
only):
Variable
set sslvpn-os-check
{disable | enable}
config sslvpn-os-check-
list {windows-2000 |
windows-xp}
set action {allow |
check-up-to-date | deny}
set latest-patch-level
{disable | 0 - 255}
set tolerance
{tolerance_num}

Configuration Example

The following configuration allows a Windows 2000 user with patch level 2
(
latest-patch-level minus tolerance
VPN services, as well as any Windows XP users.
config vpn ssl settings
set sslvpn-enable enable
set tunnel-endip 10.1.1.10
set tunnel-startip 10.1.1.1
end
config user group
edit "g1"
set group-type sslvpn
set sslvpn-tunnel enable
set sslvpn-tunnel-startip 10.1.1.1
set sslvpn-tunnel-endip 10.1.1.10
set sslvpn-webapp enable
set sslvpn-os-check enable
config sslvpn-os-check-list "windows-2000"
set action check-up-to-date
set latest-patch-level 3
Configuring a FortiGate SSL VPN
Description
Enable or disable SSL VPN OS patch level check.
Default disable.
Configure the OS of the patch level check.
Available when set sslvpn-os-check is set to
enable.
Specify how to perform the patch level check.
• allow - any level is permitted
• check-up-to-date - some patch levels are permitted,
make selections for latest-patch-level and
tolerance
• deny - OS version does not permit access
Available when set sslvpn-os-check is set to
check-up-to-date.
Specify the latest allowed patch level. Default 4 for
Windows 2000, 2 for Windows XP.
Available when action is set to enable.
Specify the lowest allowable patch level tolerance.
Equals latest-patch-level minus tolerance
and above. Default for Windows 2000 and Windows XP
is 0.
Available when action is set to check-up-to-date.
) and above permission to access SSL
FortiOS v3.0 MR7 SSL VPN User Guide
01-30007-0348-20080718