Skip to main content
dhnish
dhnish
New Member
August 9, 2017
Question

New to FG-90D; Assigning specific IP/IP Group to access certain sites

  • August 9, 2017
  • 1 reply
  • 4956 views

Hai

 

Dear support,

Using FG-90D, how do i assign either specific IP or Group-of IPs  having access to facebook?

Please help.

Thank you.

.d

    1 reply

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    August 9, 2017

    hi,

     

    and welcome to the forums.

     

    The forums are a self-help platform from users and partners, run in their spare time, for exchange of experience and practices. If you expect the Fortinet support to help you, this is not the right place. With a valid support contract FTNT is obliged to assist you. Open a ticket at support.fortinet.com .

     

    Anyhow, we would like to give you hints but I would ask you to supply more information. What are you planning to achieve? Are you talking about source addresses, destination addresses, NAT, ...? How is the application FB related to the problem?

    dhnish
    dhnishAuthor
    New Member
    August 9, 2017

    Hai

    Dear Ede,

    a) Overall security policy blocks all social-sites.

    b) for specific business need, i need certain user/users to have access to FB site.

    Ques: How do i do that in FG-90D as i wish to have a Group setting and no need to add policy an IP at a time.

         if there is a better way, hope you can advice.

    Thank you.

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    August 9, 2017

    Let's assume your FGT is running FOS v5.2 or v5.4 - please specify.

     

    Use a policy with authentication! If you create a regular security policy, with source and destination addresses, service etc. from 'internal' to 'wan' then just add a (already configured) user group to 'source address'. Now, users have to first authenticate against the FGT and are then allowed to send traffic across that policy.

    If the number of users is small, say up to 20 users, you can create local user accounts on the FGT. Or create remote authentication via MSAD/LDAP.

    If you don't like that idea you could authenticate via the device ID. For that, device detection has to be enabled on the 'internal' interface. The disadvantage of this is that permission is tied to hardware, not knowledge.

     

    You find all of this, concepts and examples, in the 'FortiOS Handbook' for your version, from docs.fortinet.com. Read into it to get inspired how these scenarios are handled with a FGT.

    Terms & ConditionsAccessibility statement