|
After configuring FSSO authentication, when a user logs into their workstation, the administrator can verify that the FSSO user is detected on the FortiGate using the following command:
This command displays the list of FSSO-learned users along with their IP addresses, group memberships, and logon time.
diagnose debug authd fsso list | grep 10.108.3.14
----FSSO logons----
IP: 10.108.3.14 User: NSE8-USER1 Groups: CN=NSE8GRP,CN=USERS,DC=DXB-NSE8,DC=LAB Workstation: 10.108.3.14 MemberOf: CN=NSE8GRP,CN=USERS,DC=DXB-NSE8,DC=LAB
Or:
diagnose firewall auth list | grep -i -A 7 10.108.3.14
The administrator can use the commands below to confirm which firewall policy the FSSO user is being authenticated on.
diagnose system session filter src 10.108.3.14
Or:
diagnose system session filter dst x.x.x.x <----- Replace x.x.x.x with the destination IP.
Follow the command above with:
diagnose system session list
session info: proto=6 proto_state=01 duration=10 expire=3589 timeout=3600 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
origin-shaper=
reply-shaper=
per_ip_shaper=
class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
user=NSE8-USER1 auth_server=fsso_lab state=may_dirty authed acct-ext
statistic(bytes/packets/allow_err): org=408/4/1 reply=858/3/1 tuples=2
tx speed(Bps/kbps): 38/0 rx speed(Bps/kbps): 81/0
orgin->sink: org pre->post, reply pre->post dev=4->3/3->4 gwy=10.0.23.254/0.0.0.0
hook=post dir=org act=snat 10.108.3.14:64381->92.123.159.240:80(10.0.20.123:64381)
hook=pre dir=reply act=dnat 92.123.159.240:80->10.0.20.123:64381(10.108.3.14:64381)
pos/(before,after) 0/(0,0), 0/(0,0)
misc=0 policy_id=5 pol_uuid_idx=16428 auth_info=33554482 chk_client_info=0 vd=0
serial=00000f8d tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id=00000000 ngfwid=n/a
npu_state=0x000100
no_ofld_reason: npu-flag-off
config firewall policy
edit 5
set name "fsso"
set uuid ac65f320-a99d-51f0-6d8f-7e8ab4d8d4d4
set srcintf "port2"
set dstintf "port1"
set action accept
set srcaddr "all"
set dstaddr "all"
set schedule "always"
set service "ALL"
set nat enable
set fsso-groups "CN=NSE8GRP,CN=USERS,DC=DXB-NSE8,DC=LAB"
next
end
config user fsso
edit "fsso_lab"
set server "10.108.3.15"
set password ENC Gc8nX
set ldap-server "lab-ldap"
next
end
Related article:
Technical Tip: How to check users logged in using FSSO on FortiGate
|
