Allow 'Email / VoIP / Slack / Teams' traffic without Azure AD Firewall Authentication

Forum|Forum|4 years ago
April 8, 2022
1 reply
3960 views

I've configure the FortiGate on our network to authenticate firewall traffic using Azure AD as the IdP. All Internet access works as expected once each user has authenticated to Azure.

Users are complaining that first thing in a morning several applications (Teams, Slack, Outlook, Softphones, etc) are not working until they manually launch their browser (which in turn authenticates them to the FortiGate). Something that some of them forget to do!

Is there a way I can exempt these applications so that they work regardless of whether or not the user has authenticated to the FortiGate?

FortiGate

Best answer by Debbie_FTNT

Hey Marcus,

I'm sorry to say I haven't found an easy workaround to exempt Teams and Slack from captive portal as yet.

It would require a feature request to allow adding Internet Service entries to the captive portal exemptions.

You could manually add FQDNs (probably wildcard FQDNs as well) to the exempt destinations, but that's about all I can suggest.

If that's insufficient, you could open a Technical Support case to see if the engineers then can come up with a solution, but that would be at least a bit out of scope, as TAC support handles break&fix scenarios, not design questions.

If you do want to go the Feature Request route, you can reach out to your Fortinet Sales partner for that.

Debbie_FTNT

Staff & Editor

Hey Marcus,

you would essentially need exemption policies; a policy on top of the default internet policy with no authentication requirements (no user group).

What shape that takes depends a bit on your setup and how authentication is triggered, and if this is an explicit proxy setup, then it will be very tricky if not impossible, because authentication requirements for proxy are somewhat divorced from the proxy policies.

MarcusCopeAuthor

Explorer

Hi Debbie,

Thanks for the reply, here is a screenshot of our Internet access policy -

I've placed authentication exemption rules before the general Internet access policy, e.g.

These rules don't have any authentication requirements.

First thing in the morning, users receive the follow notification -

When they click on the 'Tap to open the browser and connect' - their default web browser opens at a Captive Portal and redirected to Azure AD. This all works fine!