Remote Access VPN based on AD group membership

Forum|Forum|3 years ago
September 13, 2022
3 replies
3783 views

I'm trying to setup a 200F so that multiple AD groups can connect to the site using FortiClient (IPsec not SSL) for VPN access. Group1 should be allowed to a subset of ips, group2 a different set of ips, etc. Should I just create the groups on the FGT and then make multiple rules from the VPN zone to LAN and just call the respective group in the source for each 1? Or will that match all users regardless since they will have the same source up(from the DHCP pool)?

gfleming

Staff

You can do it both ways. Have a different VPN portal with unique IP Pool for users based on different AD group membership. Or, put everyone in the same portal with the same IP Pool and use Firewall Policies to restrict access using AD group membership.

On a Firewall Policy if you define two rules each with the same source and dest IP but different source user groups, then you will only match the policy that has the correct user.

Then, create different portals for each respective group with the relevant restrictions in place.

mumbles202Author

New Member

Thanks for the reply. This is for IPsec so are different portals an option? I know for SSL I would have more options but not going that route yet.

Vichu_94

Staff

Hi

For Ipsec tunnel, you could configure inherit from policy on the ipsec phase 1 of the firewall

Then you could configure the required firewall policy with groups for each policy.
When users connect to the VPN, the user would be able to access the required resources based on the firewall policy

Regards

Sign up

Login with SSO

Login to the community

Login with SSO