Authentication policy extensions
By default, unauthenticated traffic is permitted to fall to the next policy. This means that unauthenticated users are only forced to authenticate against a policy when there are no other matching policies. To avoid this, you can force authentication to always take place.
To set that authentication requirement:
config user setting
set auth-on-demand {always | implicitly}
end
Where:
|
|
Always trigger firewall authentication on demand. |
|
|
Implicitly trigger firewall authentication on demand. This is the default setting (and the behavior in FortiOS 6.0 and earlier). |
In the following example, authentication is required; traffic that would otherwise be allowed by the second policy is instead blocked by the first policy.
To use forced authentication:
config user setting
set auth-on-demand always
end
config firewall policy
edit 1
set name "QA to Database"
set srcintf "port10"
set dstintf "port9"
set srcaddr "QA_subnet"
set dstaddr "Database"
set action accept
set schedule "always"
set service "ALL"
set fsso disable
set groups "qa_group"
set nat enable
next
edit 2
set name "QA to Internet"
set srcintf "port10"
set dstintf "port9"
set srcaddr "QA_subnet"
set dstaddr "all"
set action accept
set schedule "always"
set service "ALL"
set fsso disable
set nat enable
next
end
