Skip to main content
raphael_lage
raphael_lage
New Member
November 4, 2021
Solved

Restrict IPs for LDAP access

  • November 4, 2021
  • 1 reply
  • 4584 views

Hello everyone. Today in my company we have 4 fortigates and we all use local user. We’re looking to switch to AD authentication, but I need to restrict the Ips that can be accessed using users. Today as we use local user I did the restriction using Trusted hosts. How could I do the same, but for AD users?

    Best answer by xsilver_FTNT

    Hi,

     

    1. you can still have locally defined users but 'remote' type pointing to LDAP. One by one used in User Group which can be used somewhere in Firewall policies .. that's closest to complete local password based users.

    HINT: Keep in mind that FortiOS is Unix-based system and so usernames ARE case sensitive in this case!

     

    Example:

    edit "Alice"    set type ldap    set ldap-server "LDAP-SRV" next

     

    2. you can have a group pointing directly to LDAP, so no local users and anyone matching the group filter will be considered member. In this case user authentication is handled towards external server without username match on FortiGate and so if LDAP server is case insensitive on usernames, like MSFT AD is, then mixed character cases in username will work.

     

    Example:

    edit "Group_LDAP"    set member "LDAP-SRV"    config match       edit 1       set server-name "LDAP-SRV"       set group-name "CN=Domain Users,CN=Users,DC=example,DC=org"    next    end next

     

    Those will work mainly as your previous users.

    I'm not sure if I do understand to restrict IP requirement as that is usually applied to Administrators logins, not to users.

    More might be seen here: https://docs.fortinet.com/document/fortigate/6.4.7/administration-guide/954635/getting-started

    And if you were speaking about admins, then here:

    https://docs.fortinet.com/document/fortigate/6.4.7/administration-guide/747268/configuring-wildcard-admin-accounts 

     

    1 reply

    xsilver_FTNT
    Staff
    xsilver_FTNTAnswer
    Staff
    November 4, 2021

    Hi,

     

    1. you can still have locally defined users but 'remote' type pointing to LDAP. One by one used in User Group which can be used somewhere in Firewall policies .. that's closest to complete local password based users.

    HINT: Keep in mind that FortiOS is Unix-based system and so usernames ARE case sensitive in this case!

     

    Example:

    edit "Alice"    set type ldap    set ldap-server "LDAP-SRV" next

     

    2. you can have a group pointing directly to LDAP, so no local users and anyone matching the group filter will be considered member. In this case user authentication is handled towards external server without username match on FortiGate and so if LDAP server is case insensitive on usernames, like MSFT AD is, then mixed character cases in username will work.

     

    Example:

    edit "Group_LDAP"    set member "LDAP-SRV"    config match       edit 1       set server-name "LDAP-SRV"       set group-name "CN=Domain Users,CN=Users,DC=example,DC=org"    next    end next

     

    Those will work mainly as your previous users.

    I'm not sure if I do understand to restrict IP requirement as that is usually applied to Administrators logins, not to users.

    More might be seen here: https://docs.fortinet.com/document/fortigate/6.4.7/administration-guide/954635/getting-started

    And if you were speaking about admins, then here:

    https://docs.fortinet.com/document/fortigate/6.4.7/administration-guide/747268/configuring-wildcard-admin-accounts 

     

    raphael_lage
    raphael_lageAuthor
    New Member
    November 4, 2021

    Thank you for your reply. Today we use local administrators and do IP restrictions that can log in with these users. I would like to do the same, but using authenticated users via AD. Can’t do that? If I create as per the documentation below, putting users in the policy, does it work? https://kb.fortinet.com/k....do?externalID=FD46240

    xsilver_FTNT
    Staff
    xsilver_FTNT
    Staff
    November 5, 2021

    Users, user groups and especially firewall policies are applied to pass-through traffic.

    Access to the unit itself. Admin access. Is driven by access profiles, allowaccess on interfaces (and possibly by local-in-policies but that's advanced tech).

     

    Easiest way is to follow my second link from previous post, about wildcard LDAP admin. And make one. It's a wildcard / placeholder, for any possible AD user who belongs to set group match. In example for 'edit "ldap_grp"' those possible admins have to be members of AD group "CN=GRP,OU=training,DC=example,DC=COM".

    Pay attention to that group match, and I would also highly recommend to use this specific group, in example "ldap_grp", for admin access only! Not anywhere else.

     

    Another approach would be to make single local admins, see "Alice" below. Pointed to LDAP, and so their credentials will be verified not locally, but against designated LDAP server defined as remote group, so group match is again possible.

    And such local admin accounts can also have backup password usable in case LDAP is unreachable.

     

    config system admin

    edit "Alice"   set remote-auth enable   set accprofile "super_admin"   set vdom "root"   set remote-group "remote-admins-ldap"   set password ENC SH2cGT11lw47mF6ZNxsMz4IfS0eWn9s3yYybd9Wd20vYoyTMSfIoxpiZikDO2E=   next

    end

     

    Above example is similar to this KB, but swap anything RADIUS (like config user radius for config user ldap etc.) for LDAP and it will work.

    https://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD32808 

     

    As those will be solo admins on FGT then same rule and trusted hosts does apply on those as if those would be completely local admins.

     

    Have a look to documentation and/or Knowledge Base but focus on admin access to FortiGate itself.

     

    Terms & ConditionsAccessibility statement