Configuring the NPS server RADIUS client
On a Network Policy Server, configure a RADIUS client for the FortiGate.
For corporate services, the predefined firewall service group named Windows AD is used.
|
In order to leverage Active Directory (AD) groups to define who belongs to a given user group, the RADIUS server must be configured to return RADIUS AVP Fortinet-Group-Name that matches the group defined in the User Group > Remote Groups > Radius server > Group Name. For more information, see the FortiOS Administration Guide. |
To configure the NPS server RADIUS client settings:
- On a Network Policy server, go to RADIUS Clients and Servers > RADIUS Clients.
- Right-click RADIUS Clients to select New.
- Enter the name, IP address/DNS address, and a secret.
-
Go to Policies > Network Policies, and define network policies for each of the following user groups: Engineering, IT, Staff, and Admin.
Within each policy, the conditions are that the authenticating user belongs to a particular group in AD. (Policy Properties > Conditions)
When a user who belongs to this group authenticates, a Vendor-Specific-Attribute (VSA) is configured to return, for example,
Fortinet-Group-Name=IT(orFortinet-Group-Name=Engineering, and so on).
FortiGate matches the VSA in the Groups: Specify section of the User Group > Remote Group. It is a good idea to return a VSA that matches the group, although it is not necessary.