Skip to main content
jbrashear
jbrashear
New Member
December 2, 2016
Question

Fortios 5.4 SSL VPN with RADIUS or LDAP authentication without local users?

  • December 2, 2016
  • 1 reply
  • 14442 views

Hello all,

 

I'm setting up 2 new 300D's running 5.4.  I have a working SSL VPN that I set up for testing, however that is using local accounts on the firewall.  I want to have all ssl vpn users authenticated against a RADIUS or LDAP server.  I was able to configure both on the Fortigate (LDAP and RADIUS servers and verified communication).  Where I'm running into a snag is how do I get the VPN to authenticate without a locally configured user account?  I don't want to set up 50 + accounts on the VPN. I just want it to see the inbound connection and then use the AD username and password supplied by the user to allow access.  This was very simple to do on my ASA.  I've found some stuff in the KB, etc, but nothing is very verbose for fotios 5.4.  Thanks in advance for any and all help.

 

 

JB

    1 reply

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    December 2, 2016

    I haven't checked/done this with 5.4 but I wouldn't expect any significant difference. If you don't find any 5.4 specific documentation, the chances are there might be no change at all. You probably found below cookbook for 5.2:

    http://cookbook.fortinet.com/ssl-vpn-radius-authentication/

    Since you already have SSL VPN up, you care only Ch. 2 and 3. I would just try with a test user account. Make sure you test from the FG first before testing from a client device.

    By the way, the cook book writers are quite responsive based on my experiences in the past. You might want to ask them why they don't have 5.4 version to know if no change.

     

    JayWinksInLine
    JayWinksInLine
    New Member
    February 8, 2017

    Surprised there's been no further discuss on this thread... I find no way to do this with LDAP. This was easy in older FortiOS. When I try to configure the policy, it does not show the FSSO or LDAP group as a choice.

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    February 8, 2017

    I see group types at two running FGs with 5.2 and 5.4 are the same.

    firewall        firewall fsso-service    Fortinet Single Sign-On Service. rsso            RADIUS based Single Sign-On Service. guest           Guest

    Both units are currently running SSL VPN with a RADIUS server. Then firewall policy is using the group (type=firewall) for SSL VPN users in "set groups" statement. So I don't see any sign of changes between them.

    Terms & ConditionsAccessibility statement