What it Does
Fortinet Single Sign-On (SSO) is the authentication protocol by which users can transparently authenticate to FortiGate. FortiNAC acts as a Collector Agent: It collects and compiles information about user logons. The information is sent to the FortiGate in the form of Logon and Logoff events. These events contain:
-
Device Information: IP address
-
User information: User ID or MAC address (if no User ID)
-
User Group Filter: FortiNAC User Group, Host Group or Firewall Tag
Logon/logoff event information: dynamic, real-time information the FortiGate learns and uses to dynamically match against policies and set up connections internally so the user is known without prompting them to log on again.
Logon event triggers:
-
“Registered” device connect
-
User logon
-
IP change
-
Device status change
Logoff event triggers:
-
User logoff
-
Device disconnect
FortiGate creates one or more log entries for this logon/logoff events as appropriate.
When a user tries to access network resources, the FortiGate unit can use the firewall user list to match a firewall policy with a source group as criterion. If the IP address is known along with the user information and User Group, the policy can be matched.
Optional: Traffic from endpoints connecting to unmanaged network infrastructure can be controlled at the FortiGate. Requires FortiNAC Persistent Agent to be installed. For details see Unknown Location Endpoint Management in the Appendix.
FortiNAC v9.2.2/FOS v7 and greater: SSO information is sent over TCP 8013.
All other versions: SSO information is sent over TCP port 8000.
For more information on SSO, see the FortiOS documentation at docs.fortinet.com.