FMG 5.6 Authentication with RADIUS (Cisco ISE) users

Question

HelloWhen configuring FortiManager with Cisco ISE RADIUS Server, FMG don't attribute the good profile to the user as asked by ISE.You find below my configuration:On ISE side:[ol]i created a a new user user_ro memeber of group GROUP-RO I configured FMG device as a Network device in ISE with a PSK.I imported Fortinet RADIUS dictionary in ISE.I created an RADIUS profile based on the Fortinet dictionary (please refer to the screenshot to see the attributes sent by ISE)I creaed the AuthC and AutZ policies in ISE: If a user is member of GROUP_RO and device type is Fortinet, the Profile shoud be "AuthZ-RADIUS-GROUP-RO" (please refer to the screenshot).[/ol]on FMG side:[ol]I added the RADIUS server (Authentication type Auto)I created the profile PROFILE_RO with RO access.I created a wildcard user (I consider it as a group) from RADIUS profile and the profile is PROFILE_RO (please refer to the screenshot).[/ol]The problem is when I connect on the FMG with a user member of GROUP-RO, ISE send the necessary attributed of the Access Profile with PROFILE_RO, but the FMG consider the user as member of another profile as described below.# diagnose system admin-session list*** entry 7 *** session_id: 12427 (seq: 0) username: user_ro admin template: GROUP-RW from: GUI(1.1.1.1) (type 1) profile: SUPERUSER (type 1) adom: root session length: 559 (seconds)idle: 301 (seconds) Anyone has any idea how to resolve this issue?Thank you for your help!

mitm2010 · Answer

Please find in the attached file the group config in FMG.

Sign up

Login with SSO

Login to the community

Login with SSO