Fortinet black logo

Administration Guide

Configuring firewall authentication

Configuring firewall authentication

In this example, a Windows network is connected to the FortiGate on port 2, and another LAN, Network_1, is connected on port 3.

All Windows network users authenticate when they log on to their network. Engineering and Sales groups members can access the Internet without reentering their authentication credentials. The example assumes that you have already installed and configured FSSO on the domain controller.

LAN users who belong to the Internet_users group can access the Internet after entering their username and password. The example shows two users: User1, authenticated by a password stored in FortiOS; and User 2, authenticated on an external authentication server. Both users are local users since you create the user accounts in FortiOS.

  1. Create a locally authenticated user account.
  2. Create a RADIUS-authenticated user account.
  3. Create an FSSO user group.
  4. Create a firewall user group.
  5. Define policy addresses.
  6. Create security policies.

Creating a locally authenticated user account

User1 is authenticated by a password stored in FortiOS.

To create a locally authenticated user account in the GUI:
  1. Go to User & Authentication > User Definition. Click Create New.
  2. Configure the following settings:

    Setting

    Configuration

    User Type

    Local User

    User Name

    User1

    Password

    hardtoguess1@@1

    User Account Status

    Enabled

  3. Click Submit.
To create a locally authenticated user account in the CLI:

config user local

edit user1

set type password

set passwd hardtoguess1@@1

next

end

Creating a RADIUS-authenticated user account

You must first configure FortiOS to access the external authentication server, then create the user account.

To create a RADIUS-authenticated user account in the GUI:
  1. Go to User & Authentication > RADIUS Servers. Click Create New.
  2. Configure the following settings:

    Setting

    Configuration

    Name

    OurRADIUSsrv

    Authentication method

    Default

    Primary Server

    IP/Name

    10.11.101.15

    Secret

    OurSecret

  3. Click OK.
  4. Go to User & Authentication > User Definition. Click Create New.
  5. Configure the following settings:

    Setting

    Configuration

    User Type

    Remote RADIUS User

    User Name

    User2

    RADIUS Server

    OurRADIUSsrv

    User Account Status

    Enabled

  6. Click Submit.
To create a RADIUS-authenticated user account in the CLI:

config user radius

edit OurRADIUSsrv

set server 10.11.102.15

set secret OurSecret

set auth-type auto

next

end

config user local

edit User2

set name User2

set type radius

set radius-server OurRADIUSsrv

next

end

Creating an FSSO user group

This example assumes that you have already set up FSSO on the Windows network and that it used advanced mode, meaning that it uses LDAP to access user group information. You must do the following:

  • Configure LDAP access to the Windows AD global catalog
  • Specify the collector agent that sends user logon information to FortiOS
  • Select Windows user groups to monitor
  • Select and add the Engineering and Sales groups to an FSSO user group
To create an FSSO user group in the GUI:
  1. Configure LDAP for FSSO:
    1. Go to User & Authentication > LDAP Servers. Click Create New.
    2. Configure the following settings:

      Setting

      Configuration

      Name

      ADserver

      Server Name / IP

      10.11.101.160

      Distinguished Name

      dc=office,dc=example,dc=com

      Bind Type

      Regular

      Username

      cn=FSSO_Admin,cn=users,dc=office,dc=example,dc=com

      Password

      Enter a secure password.

    3. Leave other fields as-is. Click OK.
  2. Specify the collector agent for FSSO;
    1. Go to Security Fabric > External Connectors. Click Create New.
    2. Under Endpoint/Identity, select Fortinet Single Sign-On Agent.
    3. Configure the following settings:

      Setting

      Configuration

      Name

      Enter the Windows AD server name. This name appears in the Windows AD server list when you create user groups. In this example, the name is WinGroups.

      Server IP/Name

      Enter the IP address or name of the server where the agent is installed. The maximum name length is 63 characters. In this example, the IP address is 10.11.101.160.

      Password

      Enter the password of the server where the agent is installed. You only need to enter a password for the collector agent if you configured the agent to require authenticated access.

      If the TCP port used for FSSO is not the default, 8000, you can run the config user fsso command to change the setting in the CLI.

      Collector Agent AD access mode

      Advanced

      LDAP Server

      Select the previously configured LDAP server. In this example, it is ADserver.

      User/Groups/Organization Units

      Select the users, groups, and OUs to monitor.

    4. Click OK.
  3. Create the FSSO_Internet_users user group:
    1. Go to User & Authentication > User Groups. Click Create New.
    2. Configure the following settings:

      Setting

      Configuration

      Name

      FSSO_Internet_users

      Type

      Fortinet Single Sign-On (FSSO)

      Members

      Engineering, Sales

    3. Click OK.
To create an FSSO user group in the CLI:

config user ldap

edit "ADserver"

set server "10.11.101.160"

set dn "cn=users,dc=office,dc=example,dc=com"

set type regular

set username "cn=administrator,cn=users,dc=office,dc=example,dc=com"

set password set_a_secure_password

next

end

config user fsso

edit "WinGroups"

set ldap-server "ADserver"

set password **********

set server "10.11.101.160"

next

end

config user group

edit FSSO_Internet_users

set group-type fsso-service

set member CN=Engineering,cn=users,dc=office,dc=example,dc=com CN=Sales,cn=users,dc=office,dc=example,dc=com

next

end

Creating a firewall user group

This example shows a firewall user group with only two users. You can add additional members.

To create a firewall user group in the GUI:
  1. Go to User & Authentication > User Groups. Click Create New.
  2. Configure the following settings:

    Setting

    Configuration

    Name

    Internet_users

    Type

    Firewall

    Members

    User1, User2

  3. Click OK.
To create a firewall user group in the CLI:

config user group

edit Internet_users

set group-type firewall

set member User1 User2

next

end

Defining policy addresses

To define policy addresses:
  1. Go to Policy & Objects > Addresses.
  2. Click Create New > Address.
  3. Configure the following settings:

    Setting

    Configuration

    Name

    Internal_net

    Type

    Subnet

    IP/Netmask

    10.11.102.0/24

    Interface

    Port 3

  4. Click OK.
  5. Create another new address by repeating steps 2-4 using the following settings:

    Setting

    Configuration

    Name

    Windows_net

    Type

    Subnet

    IP/Netmask

    10.11.101.0/24

    Interface

    Port 2

Creating security policies

You must create two security policies: one for the firewall group connecting through port 3, and one for the FSSO group connecting through port 2.

To create security policies using the GUI:
  1. Go to Policy & Objects > Firewall Policy.
  2. Click Create New.
  3. Configure the following settings:

    Setting

    Configuration

    Incoming Interface

    Port2

    Source Address

    Windows_net

    Source User(s)

    FSSO_Internet_users

    Outgoing Interface

    Port1

    Destination Address

    all

    Schedule

    always

    Service

    ALL

    NAT

    Enabled.

    Security Profiles

    You can enable security profiles as desired.

  4. Click OK.
  5. Create another new policy by repeating steps 2-4 using the following settings:

    Setting

    Configuration

    Incoming Interface

    Port3

    Source Address

    Internal_net

    Source User(s)

    Internet_users

    Outgoing Interface

    Port1

    Destination Address

    all

    Schedule

    always

    Service

    ALL

    NAT

    Enabled.

    Security Profiles

    You can enable security profiles as desired.

  6. Click OK.
To create security policies using the CLI:

config firewall policy

edit 0

set srcintf port2

set dstintf port1

set srcaddr Windows_net

set dstaddr all

set action accept

set groups FSSO_Internet_users

set schedule always

set service ANY

set nat enable

next

end

config firewall policy

edit 0

set srcintf port3

set dstintf port1

set srcaddr internal_net

set dstaddr all

set action accept

set schedule always

set groups Internet_users

set service ANY

set nat enable

next

end

Configuring firewall authentication

In this example, a Windows network is connected to the FortiGate on port 2, and another LAN, Network_1, is connected on port 3.

All Windows network users authenticate when they log on to their network. Engineering and Sales groups members can access the Internet without reentering their authentication credentials. The example assumes that you have already installed and configured FSSO on the domain controller.

LAN users who belong to the Internet_users group can access the Internet after entering their username and password. The example shows two users: User1, authenticated by a password stored in FortiOS; and User 2, authenticated on an external authentication server. Both users are local users since you create the user accounts in FortiOS.

  1. Create a locally authenticated user account.
  2. Create a RADIUS-authenticated user account.
  3. Create an FSSO user group.
  4. Create a firewall user group.
  5. Define policy addresses.
  6. Create security policies.

Creating a locally authenticated user account

User1 is authenticated by a password stored in FortiOS.

To create a locally authenticated user account in the GUI:
  1. Go to User & Authentication > User Definition. Click Create New.
  2. Configure the following settings:

    Setting

    Configuration

    User Type

    Local User

    User Name

    User1

    Password

    hardtoguess1@@1

    User Account Status

    Enabled

  3. Click Submit.
To create a locally authenticated user account in the CLI:

config user local

edit user1

set type password

set passwd hardtoguess1@@1

next

end

Creating a RADIUS-authenticated user account

You must first configure FortiOS to access the external authentication server, then create the user account.

To create a RADIUS-authenticated user account in the GUI:
  1. Go to User & Authentication > RADIUS Servers. Click Create New.
  2. Configure the following settings:

    Setting

    Configuration

    Name

    OurRADIUSsrv

    Authentication method

    Default

    Primary Server

    IP/Name

    10.11.101.15

    Secret

    OurSecret

  3. Click OK.
  4. Go to User & Authentication > User Definition. Click Create New.
  5. Configure the following settings:

    Setting

    Configuration

    User Type

    Remote RADIUS User

    User Name

    User2

    RADIUS Server

    OurRADIUSsrv

    User Account Status

    Enabled

  6. Click Submit.
To create a RADIUS-authenticated user account in the CLI:

config user radius

edit OurRADIUSsrv

set server 10.11.102.15

set secret OurSecret

set auth-type auto

next

end

config user local

edit User2

set name User2

set type radius

set radius-server OurRADIUSsrv

next

end

Creating an FSSO user group

This example assumes that you have already set up FSSO on the Windows network and that it used advanced mode, meaning that it uses LDAP to access user group information. You must do the following:

  • Configure LDAP access to the Windows AD global catalog
  • Specify the collector agent that sends user logon information to FortiOS
  • Select Windows user groups to monitor
  • Select and add the Engineering and Sales groups to an FSSO user group
To create an FSSO user group in the GUI:
  1. Configure LDAP for FSSO:
    1. Go to User & Authentication > LDAP Servers. Click Create New.
    2. Configure the following settings:

      Setting

      Configuration

      Name

      ADserver

      Server Name / IP

      10.11.101.160

      Distinguished Name

      dc=office,dc=example,dc=com

      Bind Type

      Regular

      Username

      cn=FSSO_Admin,cn=users,dc=office,dc=example,dc=com

      Password

      Enter a secure password.

    3. Leave other fields as-is. Click OK.
  2. Specify the collector agent for FSSO;
    1. Go to Security Fabric > External Connectors. Click Create New.
    2. Under Endpoint/Identity, select Fortinet Single Sign-On Agent.
    3. Configure the following settings:

      Setting

      Configuration

      Name

      Enter the Windows AD server name. This name appears in the Windows AD server list when you create user groups. In this example, the name is WinGroups.

      Server IP/Name

      Enter the IP address or name of the server where the agent is installed. The maximum name length is 63 characters. In this example, the IP address is 10.11.101.160.

      Password

      Enter the password of the server where the agent is installed. You only need to enter a password for the collector agent if you configured the agent to require authenticated access.

      If the TCP port used for FSSO is not the default, 8000, you can run the config user fsso command to change the setting in the CLI.

      Collector Agent AD access mode

      Advanced

      LDAP Server

      Select the previously configured LDAP server. In this example, it is ADserver.

      User/Groups/Organization Units

      Select the users, groups, and OUs to monitor.

    4. Click OK.
  3. Create the FSSO_Internet_users user group:
    1. Go to User & Authentication > User Groups. Click Create New.
    2. Configure the following settings:

      Setting

      Configuration

      Name

      FSSO_Internet_users

      Type

      Fortinet Single Sign-On (FSSO)

      Members

      Engineering, Sales

    3. Click OK.
To create an FSSO user group in the CLI:

config user ldap

edit "ADserver"

set server "10.11.101.160"

set dn "cn=users,dc=office,dc=example,dc=com"

set type regular

set username "cn=administrator,cn=users,dc=office,dc=example,dc=com"

set password set_a_secure_password

next

end

config user fsso

edit "WinGroups"

set ldap-server "ADserver"

set password **********

set server "10.11.101.160"

next

end

config user group

edit FSSO_Internet_users

set group-type fsso-service

set member CN=Engineering,cn=users,dc=office,dc=example,dc=com CN=Sales,cn=users,dc=office,dc=example,dc=com

next

end

Creating a firewall user group

This example shows a firewall user group with only two users. You can add additional members.

To create a firewall user group in the GUI:
  1. Go to User & Authentication > User Groups. Click Create New.
  2. Configure the following settings:

    Setting

    Configuration

    Name

    Internet_users

    Type

    Firewall

    Members

    User1, User2

  3. Click OK.
To create a firewall user group in the CLI:

config user group

edit Internet_users

set group-type firewall

set member User1 User2

next

end

Defining policy addresses

To define policy addresses:
  1. Go to Policy & Objects > Addresses.
  2. Click Create New > Address.
  3. Configure the following settings:

    Setting

    Configuration

    Name

    Internal_net

    Type

    Subnet

    IP/Netmask

    10.11.102.0/24

    Interface

    Port 3

  4. Click OK.
  5. Create another new address by repeating steps 2-4 using the following settings:

    Setting

    Configuration

    Name

    Windows_net

    Type

    Subnet

    IP/Netmask

    10.11.101.0/24

    Interface

    Port 2

Creating security policies

You must create two security policies: one for the firewall group connecting through port 3, and one for the FSSO group connecting through port 2.

To create security policies using the GUI:
  1. Go to Policy & Objects > Firewall Policy.
  2. Click Create New.
  3. Configure the following settings:

    Setting

    Configuration

    Incoming Interface

    Port2

    Source Address

    Windows_net

    Source User(s)

    FSSO_Internet_users

    Outgoing Interface

    Port1

    Destination Address

    all

    Schedule

    always

    Service

    ALL

    NAT

    Enabled.

    Security Profiles

    You can enable security profiles as desired.

  4. Click OK.
  5. Create another new policy by repeating steps 2-4 using the following settings:

    Setting

    Configuration

    Incoming Interface

    Port3

    Source Address

    Internal_net

    Source User(s)

    Internet_users

    Outgoing Interface

    Port1

    Destination Address

    all

    Schedule

    always

    Service

    ALL

    NAT

    Enabled.

    Security Profiles

    You can enable security profiles as desired.

  6. Click OK.
To create security policies using the CLI:

config firewall policy

edit 0

set srcintf port2

set dstintf port1

set srcaddr Windows_net

set dstaddr all

set action accept

set groups FSSO_Internet_users

set schedule always

set service ANY

set nat enable

next

end

config firewall policy

edit 0

set srcintf port3

set dstintf port1

set srcaddr internal_net

set dstaddr all

set action accept

set schedule always

set groups Internet_users

set service ANY

set nat enable

next

end