By default, a FortiGate device configures both the SSL VPN portal and the administrative management GUI to listen on the same TCP port, which is 443 for HTTPS. The FortiGate appliance differentiates between administrative access and SSL VPN user access based on the URL path requested by the client's browser. This shared port configuration simplifies firewall policy creation and external access setup, as only a single port needs to be opened for both services on the external-facing interface.

A. By default, FortiGate does not use WINS servers for name resolution for SSL VPN clients. It uses the DNS servers configured in the FortiGate's system settings.

B. Requiring a client certificate for SSL VPN authentication is a security enhancement that is disabled by default. The default authentication method relies on user credentials.

C. By default, split tunneling is disabled for the full-access portal. This ensures all traffic from the remote client is routed through the FortiGate for complete security inspection.

1. Fortinet FortiOS 7.4 Administration Guide

SSL VPN

Section: SSL VPN settings.

"By default

the SSL VPN daemon runs on port 443. This may conflict with administrative access to the FortiGate on the same port. It is recommended to change the port to 10443 or 4433

or change the administrative access port." This statement confirms that by default

both services use port 443.

2. Fortinet FortiOS 7.4 CLI Reference

vpn ssl settings.

The documentation for the config vpn ssl settings command shows the default value for port is 443 and the default for client-cert is disable.

3. Fortinet FortiOS 7.4 SSL VPN Guide

Portals

Section: Configuring a portal.

The guide details the configuration of SSL VPN portals. The default full-access portal has split-tunneling disabled. The CLI default for set split-tunneling within a portal configuration is disable.