Technical Tip: How to automatically delete local user when it disconnects on the FortiAP with FortiGate automation stitch

[nathan_h]

Description

This article describes how to configure auto delete Wi-Fi local user when it disconnects on the FortiAP. This setup required FortiGate as a Wireless Controller and local users are configured on FortiGate. Automation Stitch will be used for deleting the user.

Scope

FortiGate, FortiAP.

Solution

1. Ensure to have already added FortiAP on FortiGate under WiFi Controller -> Managed FortiAPs.

2. Configure Local Users and Groups under User & Authentication -> User Groups -> Select Group > Edit.

3. Configure SSID settings and Firewall Policy under WiFi Controller -> SSIDs -> Create New -> SSID.

Go under Policy & Objects -> Firewall Policy -> Create new.

 

4. Configure Automation Stitch.

From GUI.

Trigger under Security Fabric -> Automation -> Select Trigger -> Create New.

 

Action under Security Fabric -> Automation -> Select Action -> Create New.

Stitch: under Security Fabric -> Automation -> Select Stitch -> Create New.

From CLI.

Trigger:

config system automation-trigger
     edit "Wireless_disconnected"
          set event-type event-log
          set logid 43581
          config fields
               edit 1
               set name "action"
               set value "client-disconnected-by-wtp"
               next
          end
     next
end

Action:

config system automation-action
     edit "Delete_Guest_Username"
          set action-type cli-script
          set script "config user group
edit %%log.group%%
unselect member %%log.user%%
end
config user local
delete %%log.user%%
end

diagnose firewall auth filter user %%log.user%%
diagnose firewall auth clear"
          set accprofile "super_admin"
     next
end

Stitch:

config system automation-stitch
     edit "Wireless_Auto_Delete"
          set trigger "Wireless_disconnected"
          config actions
               edit 1
               set action "Delete_Guest_Username"
               set required enable
               next
          end
     next
end

5. Connect on the Guest-Wifi SSID.

User showing connected:

 

6. Disconnect on the Guest-Wifi SSID.

The user showing it is not connected:

 

System Event logs under Log & Report -> Security Events -> Logs.

 

Automation Stitch is showing it triggered under Security Fabric -> Automation.

 

The user group shows that the guest2 user was deleted under User & Authentication -> User Groups -> Select -> Edit.