Skip to main content
douglas1942
douglas1942
New Member
June 1, 2022
Question

Multiple user groups in a policy source.

  • June 1, 2022
  • 3 replies
  • 4881 views

Hello, I have a Fortigate policy whereby I want to specify that a user has to belong to TWO user groups in order to pass the policy.

However, I am finding that the user only needs to match one group, but I want BOTH groups to be matched.

 

Is there any way to do this ?

Thank you.

3 replies

bpozdena_FTNT
Staff
bpozdena_FTNT
Staff
June 1, 2022

Hello douglas1942,

 

this is not supported as you intended to use it.  The behavior you're seeing is expected.

 

You will need to create a new user group specific for those users and use it in your FW policies.

 

HTH,

Boris 

    douglas1942
    douglas1942Author
    New Member
    June 1, 2022

    Thank you. Does anyone have any ideas how to achieve what I want ?

     

    bpozdena_FTNT
    Staff
    bpozdena_FTNT
    Staff
    June 2, 2022

    You can submit a New Feature Request via your local Fortinet Sales Engineer and ask to have a logical AND group-match option added into FortiOS. 

    ndumaj
    Staff
    ndumaj
    Staff
    June 1, 2023

    Hello,
    When two separate groups from different RADIUS/LDAP profiles are added, the FortiGate sends an Access-Request simultaneously to both RADIUS/LDAP servers, and authentication succeeds if either server sends back an Access-Accept.
    So the authentication will be handled only by one Server.

    BR

      Terms & ConditionsAccessibility statement