Skip to main content
Arsen
Arsen
New Member
February 8, 2017
Question

Fortigate RDP authentication without FSSO failure.

  • February 8, 2017
  • 1 reply
  • 7789 views

Hi, We have configured LDAP Server in our Fgate80C and added Firewall User Group with Remote Groups. We have Identity based 2 Security policies allowing this user group to access internet and terminal server by RDP. Internet access policy works well, with authentication page appearing. But TS access policy doesn't work. Firmware version is 5.4.3.  What would you suggest?

Thank You.

    1 reply

    xsilver_FTNT
    Staff
    xsilver_FTNT
    Staff
    February 9, 2017

    Hi Arsent,

     

    I guess that you are talking about policy seq. #1.

    I assume users in LAN authenticate to their workstations. Maybe LDAP is actually AD, isn't it ?

    Then user's workstations might be domain members, right ?

    If so then what about to make it FSSO and so have user's source IP pre-authenticated in time he is trying to access TS. More over, you can use TSAgent to report to Collector Agent on DC and add those users on TS to FSSO and authenticate their traffic via FSSO as well.

     

    Best regards,

    Tomas

    Arsen
    ArsenAuthor
    New Member
    February 9, 2017

    Hi xsilver_FTNT,

     

    Thank you for your quick response. 

    Yes, I am talking about policy seq #1.

    Yes, LDAP actually is AD, and user's workstations are domain members.

    With agent-based and polling mode  FSSO  everything is well. But without FSSO Firewall User Group with Remote Group doesn't identify users when they try to access TS by RDP. If users are authenticated  for internet access by policy seq #2, after that they are able to initiate RDP Session.

     

    xsilver_FTNT
    Staff
    xsilver_FTNT
    Staff
    February 10, 2017

    Hi,

     

    if we summarize, then:

    - if user tried Web page, went through HTTP/HTTP, he get authenticated through basic auth popup in web page

    - if he is previously authenticated because of web access, then he can reach TS through identity-based policy #2

    - if he attempt TS access via RDP first, and so he is unknown to firewall, he fail. How would you like to present user with firewall authentication pop-up (as for HTTP) when he used RDP protocol ?

     

    That's why I tried to promote FSSO, because user will be, most probably, known to firewall long before he will try to access resources via protocols like RDP that are not that suited/adopted to additional authentication as HTTP.

     

    Best regards,

    Tomas

    Terms & ConditionsAccessibility statement