Technical Note: FSSO - How to show the Group Name in the FortiGate replacement message
Description
Solution
This article describes the behavior that can be seen in the presence of FSSO, in which a Replacement Message presented by the FortiGate (For example: Block, Warning, etc) will show the User Name of the user but not the Group Name.
This is the expected behavior when the traffic for the user is allowed by a firewall policy that has no FSSO Group defined on it.
This is the expected behavior when the traffic for the user is allowed by a firewall policy that has no FSSO Group defined on it.
Solution
To have the FortiGate Replacement Message show the user Group Name, select an FSSO Group on the firewall policy:
Note that the FortiGate will show the name of the FSSO Group on the FortiGate that was mapped to the LDAP Group, it will not show the name of the LDAP Group.
FGT_5-6 # sh user group
config user group
edit "DEV-Group"
set group-type fsso-service
set member "OFFICELAB/DEV"
next
end
FGT_5-6 # sh firewall policy
config firewall policy
edit 1
set name "Internet-Access"
set srcintf "port2"
set dstintf "port1"
set srcaddr "all"
set dstaddr "all"
set action accept
set schedule "always"
set service "ALL"
set utm-status enable
set logtraffic all
set fsso enable
set groups "DEV-Group"
set webfilter-profile "default"
set profile-protocol-options "default"
set ssl-ssh-profile "certificate-inspection"
set nat enable
next
Note that the FortiGate will show the name of the FSSO Group on the FortiGate that was mapped to the LDAP Group, it will not show the name of the LDAP Group.
