IPSEC Dialup with multiple Radius Groups

4 replies
2727 views

Hello!

I have a Fortigate with 7.2.4 and many clients that make a dialup VPN with the Forticlient. Authentication works via XAUTH Radius through a OneSpan (formerly Vasco) Authenticator appliance - works fine.

Now I have a new requirement that some of these users must be able to access a specific network resource. Can I define multiple, separate dialup tunnels, which I distinguish via XAUTH? Or how do you handle such scenarios?

Greetings from Switzerland!
martin

akanibek

Staff

Dear Martin,

Since you are using Radius, you should be able to specify Radius Remote Groups on FGT.

Then, could you test with adding Radius Group Name attributes to Radius response from Radius Server, and adjust firewall policy for group, who should get access.

mheAuthor

Explorer II

But how can I work with multiple groups when XAUTH only allows me to specify one group that is allowed to use this dialup tunnel?

akanibek

Staff

My bad, I mixed up with SSL VPN. I could see only one solution, as you explained.

sw2090

SuperUser

couldn't you use the radius group in a policy too? There is options für litiming to users however I never used that with radius up to now (what could change hence we have a FortiAuthenticator now ;) )

Sign up

Login with SSO

Login to the community

Login with SSO