Force User Authentication over Explicit Proxyy

Hi,

policy like #2 is not gonna get hit as there is any-any-accept .. easier way without authentication.

So first get rid of any-any-accept stuff .. this is firewall and default rule is deny.

All you configure are exceptions for those you would like to explicitly allow through under some conditions.

Then to apply authentication user for example need to come through port which spawns captive portal.

Or user can be pre-authenticated via FSSO (and for Terminal Servers best equipped with TSAgent), or handle all on session basis via Explicit proxy policies .. 

Docs.fortinet.com and Authentication guide has a lot of tips.

Specific scenarios are on Cookbooks site.

Hi,

You need to play with this ones:

(my sample configuration)..

config authentication scheme     edit "ntlm"         set method ntlm     next     edit "fsso"         set method fsso     next end config authentication rule     edit "proxytest"         set srcaddr "all" - here you can define who will be authenticated...but there are more options..         set active-auth-method "ntlm"         set sso-auth-method "fsso"     next end config authentication setting     set active-auth-scheme "ntlm" end