User FSSO Policy

[MohaDarw]

Hello there, 

I have FortiGate 90D and I have connected my firewall to LDAP server successfully and added Users to Single Sign-on. The thing that I am facing now is that I want to group some users under a policy that enables them to fully access internet and the other has some restrictions and so on. 

Can any one assest please? I will be ready for any additional information you could ask.

Thank you.

[gschmitt]

You have to split up your users into two different user groups

Now create two different webfilter/application control profiles and create two internal to wan policies with the different user groups and the different profiles

[MohaDarw]

I have already done this and you may check the attached picture. But the issue in this case it is applying on some and others no. In another word, which is put in first is working. 

[CamrEntr]

Do you have users that reside in both groups? (EXAMPLE: User_A is located in "endabled users" group and "restricted_access" group)  If so, you may want to put your most restrictive policy first.

I would start with pointing your traffic to a specific interface; Internal->External or WAN1 vs. "Any" interface, then watch your Forward Traffic Log(s) by "user" or "src" and see which policy they are hitting.

[NathEmer]

Try putting both groups under policy #1 so you will have 1, 1.1 (enabled users), 1.2 (restricted users). At the moment all users will be hitting policy 1.1, those in the group will be allowed and those not will hit the implicit deny and not even get to policy 6.1.

Cheers,

Nathan