Fortiauthenticator RSSO - multi VDOM

Forum|Forum|9 years ago
July 28, 2017
5 replies
6622 views

Hi,

We have Clearpass as internal RADIUS server and send all logons via accounting to FortiAuthenticator. This includes both corporate as visitor logons. They are marked using a filter-id.

FortiAuthenticator then forwards to the FortiGate management VDOM but it doesn't leak to the corporate and guest VDOM's. How should I configure that? Ideally, accounting messages are forwarded to their domain only.

Thanks

5.4

xsilver_FTNT

Staff

Hi kvn180,

it depends what do you do with RADIUS accounting on FAC.

Basically you have two options:

1. use this RADIUS accounting source in FSSO and make the FSSO user records from those RADIUS ones you receive from Clearpass

2. do RADIUS proxy on FAC. and forward the records from Clearpass again as RADIUS accounting from FAC to FGT

In this second option, why do you send those messages to FAC and not to FGT directly (duplicitely) ?

The FGT will receive the RADIUS accounting on some interface, probably management VDOM one, so how about to have rsso enabled in RADIUS config in each VDOM and respective user group filtering per AVP Filter-Id (as you mentioned it delimit guests from users) ?

Regards,

Tomas

kvn180Author

New Member

Hi Thomas, thanks for you reply.

You suggest to receive accounting on a management VDOM interface and enable RSSO on all other VDOM's. So I did but no users enter the guest VDOM. I opened a case for this one and will share it here.

Can you add more detail on how to filter by filter-ID? I don't see that option in the GUI.

xsilver_FTNT

Staff

Hi,

you have some RADIUS server config in the VDOM ...

config user radius edit "RAD_R27_UNIX_RSSO" set rsso enable set rsso-radius-response enable set rsso-secret ENC rEkdk1AQbVV/DTAsYA5hpP7mW53as2iWQB== set rsso-endpoint-block-attribute Called-Station-Id

set sso-attribute Filter-Id next end

.. default value for sso-attribute is Class, this is the AVP where we expect to have delimiting value specifying user profile (on Carrir FortiOS) or user group membership (on FortiOS). This is then on FortiOS used in group definition ...

config user group edit "RSSO_R27" set group-type rsso <--- set sso-attribute-value "rsso-test" <--- !! this is the string we expect to be seen in Accounting Type Start/Stop and included AVP as set in RADIUS server (in above case it's Filter-ID, in default it's Class AVP). next end

Keep in mind that above mentioned group match is on exact string, case sensitive.

Mechanics are very similar to normal RADIUS group match done on Access-Accept, but this time in RSSO done on Accounting Start/Stop Types.

I've described regular Access-Accept based RADIUS Group match in this KB: http://kb.fortinet.com/kb...amp;externalId=FD36464

Best regards,

Tomas

Sign up

Login with SSO

Login to the community

Login with SSO