Skip to main content
jhoggard
jhoggard
New Member
January 7, 2021
Question

Fortimanager - User Group

  • January 7, 2021
  • 1 reply
  • 3378 views

Hi All,

 

We have a remote client VPN defined and have users authenticating against a local user group.

 

When adding local users to this user-group on the Fortimanager it shows that there is nothing to push down to the Fortigate.

 

As this user-group is just tied to the VPN it is not part of a policy. Is the only way around this by making a dummy policy with this user-group defined? as when its not part of a policy it doesn't push anything down, please can anyone confirm why this is the case?

 

Thanks,

 

    1 reply

    boneyard
    boneyard
    Valued Contributor
    January 9, 2021

    sounds very familiar, FortiManager after all these years doesn't always pick up on things which aren't tied to the more regular stuff like policies.

     

    for sure also create a support ticket for this, it might be solved in newer versions and else at least a bug is created for it.

    sw2090
    SuperUser
    sw2090
    SuperUser
    January 27, 2021

    In this case I think the "problem" is that the VPN itself is device config while the usergroup is part of the policy package. The VPN is referencing the usergroup but FMG does not consider this in the policy package. So it sees the usergroup as unused in the policy package and does not deploy the changes.

    The bug indeed is that FMG does not count crossreferences from device config to objects in policy package and mark the object in policy package as "in use". 

    As a workaround I created some dummy policy that don't harm anyone but use the usergroup so that is now in use ;)

    Terms & ConditionsAccessibility statement