Skip to main content
Potato168
Potato168
Explorer
December 10, 2021
Question

Question regarding FSSO operation

  • December 10, 2021
  • 1 reply
  • 1651 views

Hi all,

 

We just configured two Firewall rules:

 

Top Rule: only AD users allow to access the internet and logged.

Bottom Rule: Any is denied and logged.

 

I just got some issues when using FSSO with Firewall policy AD-based authentication.

 

1. Let say user A login to PC A (192.168.1.2/24), then he moves to the next PC B (192.168.1.3)and logs in. 
When the user moves back to PC A, he finds that he has no internet access now.

Issue: Is there any way to allow Fortigate to "Know" more than one Lan IP as its record so this problem can be avoided?

 

2. I wonder what if I set up the Lan interface to enable "Security mode" with Captive Portal.
Let's say above user A now still has no internet access, but redirect to the captive portal.

Once he is authenticated, he will be hit by my top rule now.

 

Issue: What is going on with PC B now? Will it lose internet connection then? - So new authentication is now needed for PC B.

1 reply

xsilver_FTNT
Staff
xsilver_FTNT
Staff
December 10, 2021

Hi,

not sure about your PC-A and PC-B .. if those are separate PCs/computers, then the login (even with the same user) is supposed to create TWO independent FSSO user records in collector and then they should appear in FGT.

diag debug authd fsso list

 

(you can set filters there) 

Example:

# diag debug authd fsso list
----FSSO logons----
IP: 10.109.19.88 User: ADMINISTRATOR Groups: CN=DOMAIN USERS,CN=USERS,DC=ALFA,DC=XSILVER,DC=ORG Workstation: C24.ALFA.XSILVER.ORG MemberOf: CN=DOMAIN USERS,CN=USERS,DC=ALFA,DC=XSILVER,DC=ORG
IP: 10.142.3.88 User: ADMINISTRATOR Groups: CN=DOMAIN USERS,CN=USERS,DC=ALFA,DC=XSILVER,DC=ORG Workstation: C24.ALFA.XSILVER.ORG MemberOf: CN=DOMAIN USERS,CN=USERS,DC=ALFA,DC=XSILVER,DC=ORG
Total number of logons listed: 2, filtered: 0
----end of FSSO logons----

 

As you see I do have TWO records for user ADMINISTRATOR. From two different IP addresses.

That's how your user should appear from PC-A and PC-B IP addresses in FSSO user list.

Same user, same group membership, but different workstations and more importantly two different IP addresses.

 

As whole FSSO is sort of passive, source IP based, pre-authentication.

 

 

However, if your user is migrating WITH HIS PC between networks, or his or any of those involved PCs has two or more NIC (network interfaces).

Then this KB might be helpful.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-FSSO-Dual-NIC/ta-p/190654?cmd=displayKC&docType=kc&externalId=FD50329

 

Terms & ConditionsAccessibility statement