| Solution |
Configuring Google API.
- Access the page https://console.developers.google.com and log in with a Google Account.
- Create a new project:
- Give the project a name and select the 'CREATE' button.
- Select the new project.
- Select 'ENABLE APIS AND SERVICES'.
- In the API list, find 'Google+ API'.
- Select 'ENABLE'.
- Select 'OAuth consent screen'.
- Select 'External' and 'CREATE'.
- Give the app a name and add a support email.
- For this example, the domain 'fortinet.br' will be 'Authorized domain'. This domain matches the FortiAuthenticator captive portal domain and the FortiGate authentication URL. Select 'SAVE AND CONTINUE'.
- Select 'SAVE AND CONTINUE' on the 'Scopes' and 'Test users' steps as well.
- Select 'Credentials' on the left panel of APIs & Services:
- Select 'CREATE CREDENTIALS' and 'OAuth client ID'.
- Select 'Web application' on 'Application type' and provide a name. Add the URL https://fac.fortinet.br/portal/social/complete/google-oauth2/ in the 'Authorized redirect URIs'. Select 'CREATE'.
Note:
This URL comes from FortiAuthenticator. See step 13 from the 'Configuring FortiAuthenticator' session to get the correct URL. Select the 'Copy redirect URL' button right in front of the 'Google' Social User.
- Take note of the 'Client ID' and 'Client secret'. These credentials will be used in step 2 of the 'Configuring FortiAuthenticator' session. Select 'OK'.
Configuring FortiAuthenticator.
- Select Authentication -> Remote Auth. Servers -> OAuth and select 'Create New'.
- Supply a name, select 'Google' on 'OAuth source', and copy and paste the 'Client ID' as shown on step 16 (Configuring Google API) into the 'Key' field. Then, copy the 'Client Secret' from step 16 and paste it into the 'Key' field.
- Select Authentication -> Portals -> Access Points, select 'Create New', and add two access points.
- Add one Access Point to reference the FortiGate LAN interface IP where the Captive Portal is enabled. For this example, it is Port4 which has 192.168.1.2 configured.
- Add another Access Point to reference the FortiGate auth-portal URL, as described in step 4 from Configuring FortiGate session.
- Select Authentication -> RADIUS Service -> Clients and select 'Create New'. Add a name and the FortiGate IP that will communicate with FortiAuthenticator. Add the 'Secret' and select 'Save'.
- Select Authentication -> User Management -> User Groups and select 'Create New'. Add a name and the 'Radius Attributes'.
The users authenticated by Google will be added to this group. This group will be used on the FortiGate configuration.
- Select Authentication -> Portals -> Portals and select 'Create New'.
- Add a name and select the option below. For this example, only 'Disclaimer' is enabled.
- Select Authentication -> Portals -> Policies -> Captive Portal and select 'Create New'.
- Add a name to the policy. Take note of the URL; it will be used as a Captive Portal URL in FortiGate settings. Select the Portal name and select 'Next'.
- Select the options as shown below. In the 'Value', set the user's IP range. Select 'Next'.
- Select the 'Access points' and the 'Radius Client'. Select 'Next'.
- Select 'Social users' and the group created before in the field 'Assign accounts to group'. Select 'Next'.
- Select 'Google' in the 'Social Users' section. Select the OAuth server created in step 2. Select 'Next'.
- Select 'Next' and then 'Update and exit'.
Configuring FortiGate.
- Enable the 'Captive Portal' on the LAN interface. Set the FortiAuthenticator URL as shown in step 9 (Configuring FortiAuthenticator). Select 'OK'.
- Select User & Authentication -> RADIUS Servers and select 'Create New'. Add FortiAuthenticator as a RADIUS server and select 'Ok'.
- Select User & Authentication -> User Groups and select 'Create New'. Add the name of the group created in step 5 (Configuring FortiAuthenticator). Select 'OK'.
- Add the FortiGate portal address:
config firewall auth-portal
set portal-addr "fgt.fortinet.br"
end
Note:
For more information, see the related article at the end of this article.
- Add the policy to allow the users to reach Google page to perform the authentication. Under Policy & Objects -> Firewall Policy, select 'Create New'. Select the LAN interface in the 'Incoming Interface' and the WAN in the 'Outgoing Interface'. Select the ISDBs 'Google-Gmail' and 'Google-Web' as the destination.
- Edit the policy through the CLI and enable the 'captive-portal-exempt'.
config firewall policy
edit 23
set uuid 6552a3e8-56ed-51ee-da10-9c25cf5e3d0a
set srcintf "port4"
set dstintf "port1"
set action accept
set srcaddr "192.168.1.0/24"
set internet-service enable
set internet-service-name "Google-Gmail" "Google-Web"
set schedule "always"
set utm-status enable
set logtraffic all
set nat enable
set captive-portal-exempt enable
next
end
Note:
For more information, check related article in the end.
- Add a new policy to allow the users to access the Internet. Add the group to the source.
Testing the internet access.
- From a test host, try to access the internet. FortiGate will redirect the user to the Captive Portal.
- Select 'Sign in with Google'. Type the credentials.
- After authentication completes, internet access will be granted.
- The Gmail user can be checked on the FortiAuthenticator console. Select Authentication -> User Management -> Social Login Users.
- The user is added to the group. Select Authentication -> User Management -> User Groups.
- The user can be seen on the FortiGate console. Select Dashboard -> User & Devices -> Firewall Users.
Related article:
|
