Skip to main content
mmjo
New Member
July 10, 2024
Solved

Fortigate destination policy with user

  • July 10, 2024
  • 3 replies
  • 2040 views

Hi.

We are using Cisco ISE with the pxgrid connector to fortimanager and that works fine.

but need to create fortigate policies with a user on both source and destination cause our cisco sda uses /19 subnets and seperated with sgt tags (pxgrid).

But when im trying to install a policy im only able to do source user, on destination there's no user tab.

Is that working as intended? cause then i need to have fortinet to make it work, out local fortinet team said it should work.

thx

 

Morten

Best answer by pminarik

Actual user/group objects can only be used as a source-filter.

 

However, what about using a dynamic address object for your goal?
As far as I know, pxgrid is intergrated via FMG pushing the info to the FGT over the FSSO protocol.

For FSSO you should be able to create a matching address object:

type = dynamic

sub type = FSSO

FSSO group = <select your pxgrid group/tag>

The resulting address object should be selectable as a destination address in a firewall policy.

Have you tried this?

3 replies

AEK
SuperUser
SuperUser
July 10, 2024

Hi

I don't know such feature on FortiOS.

AEK
smaruvala
Staff
Staff
July 10, 2024

Hi,

 

Currently, this is not supported. We have a feature request but the feature is not available in any version yet. 

 

Regards,

Shiva

pminarik
Staff
pminarikAnswer
Staff
July 10, 2024

Actual user/group objects can only be used as a source-filter.

 

However, what about using a dynamic address object for your goal?
As far as I know, pxgrid is intergrated via FMG pushing the info to the FGT over the FSSO protocol.

For FSSO you should be able to create a matching address object:

type = dynamic

sub type = FSSO

FSSO group = <select your pxgrid group/tag>

The resulting address object should be selectable as a destination address in a firewall policy.

Have you tried this?

mmjo
mmjoAuthor
New Member
July 10, 2024

Hi your a lifesaver, works like a charme.

 

Also better this way, then i dont need a ip subnet on the src and dst, the dynamic adress with the fsso/pxgrid group works.

thx