Which of the following statements are correct regarding the configuration of a FortiGate unit
as an SSL VPN gateway? (Select all that apply.)

A.
The specific routes needed to access internal resources through an SSL VPN connection
in tunnel mode from the client computer are defined in the routing widget associated with
the SSL VPN portal.

B.
In order to apply a portal to a user, that user must belong to an SSL VPN user group.

C.
Tunnel mode can only be used if the SSL VPN user groups have at least one Host
Check option enabled.

D.
The portal settings specify whether the connection will operate in web-only or tunnel
mode.