Hello,We’re experiencing an issue where firewall policies that use LDAP-based user groups are not functioning as expected. Our goal is to restrict access to certain websites for specific LDAP users.Here’s what we’ve done so far:Configured an LDAP server.Created a user group, fetched users from LDAP, and applied the group to the firewall policy.Additionally, we set up an external connector for the Active Directory Server, fetched the required users through it, and used the same FSSO user group in the firewall policy.Unfortunately, the configuration isn’t working as intended.Could someone please assist us in troubleshooting this issue and provide guidance on how to resolve it?

New Member

Question

LDAP user group based policy not working on fortigate

6 replies
1593 views

Hello,

We’re experiencing an issue where firewall policies that use LDAP-based user groups are not functioning as expected. Our goal is to restrict access to certain websites for specific LDAP users.

Here’s what we’ve done so far:

Configured an LDAP server.
Created a user group, fetched users from LDAP, and applied the group to the firewall policy.
Additionally, we set up an external connector for the Active Directory Server, fetched the required users through it, and used the same FSSO user group in the firewall policy.

Unfortunately, the configuration isn’t working as intended.

Could someone please assist us in troubleshooting this issue and provide guidance on how to resolve it?

Shyy

New Member

First of all if you are able to fetch the groups thats a good start.
Have you added in the firewall policy the network subnet in addition to the user group?
What did you exactly configure in the firewall policy that is not working exactly?

muhammadsaadAuthor

New Member

Hi,

Thanks for your reply.

I have created a firewall policy and defined the following source (user group and all).

Also in the source when we assigned only IP of the user, then the policy worked perfectly.

When we try to test with user group policy, it doesn't work.

Shyy

New Member

User group shouldn't be any different from a normal user, as long as you've fetch all the information correctly, you sure you've put the relevant subnet pool in the policy as well with the group?

muhammadsaadAuthor

New Member

We have created a user group and add the remote groups fetched from the AD on it.

After that, the firewall policy having below main details:
1. Source (user group and 'all')

2. Destination (FQDN for youtube i.e. *.youtube.com)
3. Action Deny

4. Incoming and outgoing interfaces defined accordingly.

Shyy

New Member

If that's the case you should do a debug and make sure that the traffic is going over the right firewall policy

vesnikos

New Member

it seems i am experiencing the same issue.
- LDAP is given by AD,
- CommonName Identifier is based on sAMAcountName
- My user can authenticate with their username/password
- GrpA is a FG group which has the member of the Remote grourp. The remote group inclues the user in question
- Targeted policies using GrpA are not picking up the user
- Targeted polices that include the Remote User are working as expected

OP, did you manage to solve it? It would be great if you coui

Sign up

Login with SSO

Login to the community

Login with SSO