Skip to main content
kamarale
kamarale
New Member
October 30, 2024
Question

Fortigate - Explicit proxy with Kerberos

  • October 30, 2024
  • 2 replies
  • 1909 views

Hello,

I have a question about kerberos authentication. Seeing this doc:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-explicit-proxy-authentication-with/ta-p/206219

 

Why do I need the kerberos authentcation? I mean what would be the difference if I do not configure the kerberos part and I do configure the rest (LDAP,groups, and add group to proxy policy)?

If I do not configure the kerberos part I would still have the active authentication (autentication windows popup on browser) the a user tries to go to internet,right?

I do not the benefit added with kerberos. Is it to just add SSO like authentication (passive authentication) ??

I am new to kerberos protocol...

 

thank you in advance.

Regars!

2 replies

dkochhar
Staff
dkochhar
Staff
October 30, 2024

@kamarale 
The Poll works for the FSSO agent. If you have the FSSO agents installed then it pools the additional information from the server. If you cannot install the FSSO agent therefore we can continue adding the LDAP server from the FortiGate GUI under the User and authentication.

    pminarik
    Staff
    pminarik
    Staff
    October 31, 2024

    Kerberos configuration is required for Kerberos authentication, if you decide you want to use Kerberos authentication. :)

     

    The webproxy-native authentication methods are as follows:

    Kerberos: Needs the Kerberos config

    NTLM: Needs different configuration for NTLM itself (or can proxied via Collector to the Domain, but this is not used much anymore)  

    Basic: Just the basic base64-encoded (and thus insecure!) username:password method - You need only access to the relevant user-database, be it local users, or LDAP users (with LDAP server configured)

     

    Out of these three, Kerberos is the most secure, and the most modern.

    (basic is "just plain bad" for a plaintext webproxy and NTLM is being phased out by Microsoft)

      kamarale
      kamaraleAuthor
      New Member
      October 31, 2024

      Hello,

      Thanks for the reply.

      But what would I gain if I use kerberos auth? I mean Is this optional right?

      I have configured several Fortigates (without explicit proxy) with active auth, just adding LDAP server,LDAP groups and works ok....with nothing about kerberos.

      My doubt is, why when I use explicit proxy I have to configure kerberos auth ? Or why is it recommended? What if I do not configure it and the authentication part (LDAP server,groups,etc) would be almost the same as if I do not use explicit proxy (I mean just plain active auth as in the case I mentioned earlier).

       

      To sum up, why in explicit proxy I use kerberos and without explicit proxy I do not use it. And if I do not use it is less secure....

       

      Thank you!

      Regards

      pminarik
      Staff
      pminarik
      Staff
      October 31, 2024

      Benefits of Kerberos for explicit proxy:

      - more secure (as I noted already)

      - native integration with domain-joined Windows machines: If correctly configured (on both the FGT and Win clients), the resulting behaviour can be seamless authentication (not visible to users).

       

      If you like that and it is worth the effort of setting it up, it may be a good option for you. But it absolutely isn't mandatory. Completely up to your design and goals.

       

      It technically could be done for non-explicit-proxy firewall policies, but it's not implemented in FortiOS. And it wouldn't be fully seamless either (the flow would still need to involve a redirect to a captive portal).

      A variant of this is debatably applicable to firewall policies when using them in tandem with "transparent explicit proxy" policies, but the name betrays that this involves the explicit proxy again. :)

      Terms & ConditionsAccessibility statement