IPsec with multiple NPS groups

Hi AEK,

As suggested on below article, need to configure multiple groups attributes on NPS server and also need to bind these groups on FGT.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-FortiGate-and-Microsoft-NPS-Radius/ta-p/213024

Hope this answers your question.

Regards,

Somu

Hello Somu

Thanks for your feedback.

Indeed it works, but what I mean is that with this method we have to create on Windows NPS as many network policies as the number of groups. If I have 100 groups I'll have to create 100 NPS network policies.

Is there a faster way to achieve it without creating all those NPS network policies?

Hello AEK,

No need to create multiple NPS policies, on the same policy you need to add multiple groups under Vendor Specific option, and bind these policies on FortiGate.

Regards,

Somu

Hi Somu

Thanks for your response.

But as I can see we cannot have multiple "Vendor-Specific" attributes to the same policy.

The screenshot shows the message when I try to do so. For me it seems logic, since it maps one defined AD group with one specific RADIUS "vendor-specific" response.

Or did I misunderstood your advice?

Hello AEK,

Please refer the below screen capture.

On the same vendor Specific you need to add multiple groups.

Hope this answers your question.

Regards

Somu

Oh you are right. Thanks Somu.

I guess I need also to add other Windows groups to the same policy right? (under the Conditions tab).

Hello Somu

I did as you said but unfortunately any user once connected is considered in all groups. Then they are matched by all my firewall policies that are having the groups as source.

Below a snapshot of credential test.