Skip to main content
caos
caos
New Member
September 11, 2020
Question

Is is possible to separate domain users from guests?

  • September 11, 2020
  • 1 reply
  • 2106 views

I'd like to give all non-domain users in a specific VLAN Internet only access, while domain users (or domain-joined PC's) can access internal resources as well. My plan is to apply this VLAN to meeting rooms and other areas where guests can be expected to connect their PC's.

I've followed this instruction: https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/731999/fsso-in-polling-mode-for-windows-ad

Well, it doesn't work. Everything looks OK in the FW, but I get internet only access when I connect my PC. 

 

Never mind my current config, my question is: Is it even possible to implement my scenario? The users may or may not have signed in to the domain before plugging in their laptop in the meeting room. The PC is domain-joined, the user is a domain user, but may be logged in with cached credentials. 

    1 reply

    brycemd
    brycemd
    New Member
    September 11, 2020

    It sounds like you are looking for 802.1x or perhaps a NAC solution.

     

    But, you can accomplish this with RADIUS and configuring the switch(or Access Point) for 802.1x auth and it will put the device on a specific vlan based on the RADIUS response. Doesn't have a lot to do with the FortiGate unless you have fortiswitches or using FotiNAC though.

    Terms & ConditionsAccessibility statement