Fortinet Document Library

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

Administration Guide

Creating Cisco pxGrid connector

Cisco pxGrid for FortiManager centralizes the updates from pxGrid for all FortiGate devices, and leverages the efficient FSSO protocol to apply dynamic policy updates to FortiGate.

Requirements:

  • FortiManager version 5.6 ADOM or later.

    The method described in this topic for creating fabric connectors requires version 6.0 ADOM or later.

  • FortiGate is managed by FortiManager.
  • The managed FortiGate unit is configured to work with Cisco pxGrid.
  • Configure the Cisco ISE server and download the certificate.
To configure Cisco ISE server:
  1. Create a Security Group: Go to ISE > Work Centers > TrustSec > Components > Security Groups. Click Add.

  2. Create a User Identity Group: Go to ISE > Administration > Identity Management > Groups > User Identity Groups. Click Add.

  3. Create a user and add it to User Identity Group: Go to ISE > Administration > Identity Management > Identities. Click Add.

  4. Match the Security Group with User Identity Group in the policy: Go to ISE > Work Centers >TrustSec > Components > Policy Sets. Right-click and go to Authorization policy > Basic_Authenticatied _Access and click Edit to match the Security Group with the User Identity Group.

  5. Generate the pxGrid certificate and download it to the local computer: Go to ISE > Administration > pxGrid Services > Certificate and select Generate pxGrid Certificates.

  6. See log for current users: Go to ISE > Operations > RADIUS > Live Logs.

  7. See live sessions of current users: Go to ISE > Operations > RADIUS > Live Sessions.

To configure FortiManager:
  1. Go to System Settings > Local Certificates > Import. Import the downloaded certificate.

  2. Go to Fabric View > Fabric Connectors.
  3. Click Create New.
  4. Select Cisco pxGrid and click Next.
  5. Configure the following options and click OK to create the Cisco pxGrid connector:
  6. Name

    Type a name for the fabric connector object.

    Status

    Toggle On to enable the fabric connector object. Toggle OFF to disable the fabric connector object.

    Server

    Type the IP address for Cisco ISE server.

    CA Certificate

    Select the imported CA Certificate.

    Client Certificate

    Select the imported Client Certificate.

  7. Go to Policy & Objects > Object Configuration > Single Sign-On. Select the connector and click Import.

  8. The pxGrid connector is imported. Click Close to close the import dialog.

  9. Click User Groups and create a new group. Set the type as FSSO/Cisco TrustSec, and select pxGrid user as a member.

  10. Create a policy with the ISEgroup user group and install the policy to FortiGate.

  11. Go to Fabric View > Fabric Connectors. Click Monitor to see the users currently logged in.

  12. Log on to FortiGate to view the ISE user group.

  13. On the FortiGate command line, use the diagnose debug authd fsso list to monitor the current user list.
CLI Commands for FortiManager and FortiGate
Command line for FortiManager:

config system connector

set

fsso-refresh-interval FSSO refresh interval (60 - 1800 seconds).

fsso-sess-timeout FSSO session timeout (30 - 600 seconds).

px-refresh-interval pxGrid refresh interval (60 - 1800 seconds).

px-svr-timeout pxGrid server timeout (30 - 600 seconds).

 

Realtime monitor debug to watch server connection:

diag debug application connector 255

Show retrieved Active Directory group:

diag system print connector (adom name) (user group name)

Command line for FortiGate:

diag debug authd fsso server-status

diag debug authd fsso list-------> show connected users

----FSSO logons----

IP: 192.168.1.19 User: test2 Groups: px_fc1_security_grp1 Workstation: MemberOf: fscs1

IP: 192.168.1.20 User: test2 Groups: px_fc1_security_grp1 Workstation: MemberOf: fscs1

Total number of logons listed: 2, filtered: 0

----end of FSSO logons----

diag debug authd fsso refresh-logon

diag debug authd fsso refresh-group

Creating Cisco pxGrid connector

Cisco pxGrid for FortiManager centralizes the updates from pxGrid for all FortiGate devices, and leverages the efficient FSSO protocol to apply dynamic policy updates to FortiGate.

Requirements:

  • FortiManager version 5.6 ADOM or later.

    The method described in this topic for creating fabric connectors requires version 6.0 ADOM or later.

  • FortiGate is managed by FortiManager.
  • The managed FortiGate unit is configured to work with Cisco pxGrid.
  • Configure the Cisco ISE server and download the certificate.
To configure Cisco ISE server:
  1. Create a Security Group: Go to ISE > Work Centers > TrustSec > Components > Security Groups. Click Add.

  2. Create a User Identity Group: Go to ISE > Administration > Identity Management > Groups > User Identity Groups. Click Add.

  3. Create a user and add it to User Identity Group: Go to ISE > Administration > Identity Management > Identities. Click Add.

  4. Match the Security Group with User Identity Group in the policy: Go to ISE > Work Centers >TrustSec > Components > Policy Sets. Right-click and go to Authorization policy > Basic_Authenticatied _Access and click Edit to match the Security Group with the User Identity Group.

  5. Generate the pxGrid certificate and download it to the local computer: Go to ISE > Administration > pxGrid Services > Certificate and select Generate pxGrid Certificates.

  6. See log for current users: Go to ISE > Operations > RADIUS > Live Logs.

  7. See live sessions of current users: Go to ISE > Operations > RADIUS > Live Sessions.

To configure FortiManager:
  1. Go to System Settings > Local Certificates > Import. Import the downloaded certificate.

  2. Go to Fabric View > Fabric Connectors.
  3. Click Create New.
  4. Select Cisco pxGrid and click Next.
  5. Configure the following options and click OK to create the Cisco pxGrid connector:
  6. Name

    Type a name for the fabric connector object.

    Status

    Toggle On to enable the fabric connector object. Toggle OFF to disable the fabric connector object.

    Server

    Type the IP address for Cisco ISE server.

    CA Certificate

    Select the imported CA Certificate.

    Client Certificate

    Select the imported Client Certificate.

  7. Go to Policy & Objects > Object Configuration > Single Sign-On. Select the connector and click Import.

  8. The pxGrid connector is imported. Click Close to close the import dialog.

  9. Click User Groups and create a new group. Set the type as FSSO/Cisco TrustSec, and select pxGrid user as a member.

  10. Create a policy with the ISEgroup user group and install the policy to FortiGate.

  11. Go to Fabric View > Fabric Connectors. Click Monitor to see the users currently logged in.

  12. Log on to FortiGate to view the ISE user group.

  13. On the FortiGate command line, use the diagnose debug authd fsso list to monitor the current user list.
CLI Commands for FortiManager and FortiGate
Command line for FortiManager:

config system connector

set

fsso-refresh-interval FSSO refresh interval (60 - 1800 seconds).

fsso-sess-timeout FSSO session timeout (30 - 600 seconds).

px-refresh-interval pxGrid refresh interval (60 - 1800 seconds).

px-svr-timeout pxGrid server timeout (30 - 600 seconds).

 

Realtime monitor debug to watch server connection:

diag debug application connector 255

Show retrieved Active Directory group:

diag system print connector (adom name) (user group name)

Command line for FortiGate:

diag debug authd fsso server-status

diag debug authd fsso list-------> show connected users

----FSSO logons----

IP: 192.168.1.19 User: test2 Groups: px_fc1_security_grp1 Workstation: MemberOf: fscs1

IP: 192.168.1.20 User: test2 Groups: px_fc1_security_grp1 Workstation: MemberOf: fscs1

Total number of logons listed: 2, filtered: 0

----end of FSSO logons----

diag debug authd fsso refresh-logon

diag debug authd fsso refresh-group