When browsing to an internal web server using a web-mode SSL VPN bookmark, which IP address is used as the source of the HTTP request?

The FortiGate's public IP address is used for external communication and VPN termination, not for initiating proxied requests to internal network resources.

When using web-mode SSL VPN, the FortiGate unit acts as a proxy, generating the HTTP request to the internal web server on behalf of the remote user, and thus uses its own internal IP address (typically the interface facing the internal network) as the source.

Virtual IP addresses are assigned to remote users in tunnel-mode SSL VPN for direct network access, whereas web-mode is a clientless proxy solution that does not assign virtual IPs.

The remote user's public IP address is the initial source of the traffic to the FortiGate, but the FortiGate then proxies the request to the internal server using its own internal IP.