Created on
07-06-2020
11:42 PM
Edited on
10-28-2022
02:58 AM
By
Jean-Philippe_P
Description
This article describes how to configure LDAP server and authentication scheme.
LDAP User authentication in Explicit-Proxy mode.
- Configure the LDAP server.
- Configure Authentication Scheme/rules and proxy auth settings.
- Configure firewall policies with LDAP authentication by selecting the explicit mode.
- Enabling proxy settings on workstation and test the authentication.
Solution
Configuring LDAP server.
# config user ldapConfigure Authentication Scheme.
edit "Proxy-AD"
set server "10.40.9.78"
set cnid "sAMAccountName"
set dn "dc=dubailab,dc=lab"
set type regular
set username "cn=administrator,cn=users,dc=dubailab,dc=lab"
set password xxxxxx
next
end
# config authentication schemeConfiguring Authentication Rule.
edit "ldap-scheme"
set method basic
set user-database "Proxy-AD"
next
end
# config firewall addressConfigure Proxy Authentication Settings.
edit "9-42"
set subnet 10.40.9.42 255.255.255.255
next
end
# config authentication rule
edit "ldap_rule"
set srcintf "port2"
set srcaddr "9-42"
set dstaddr "all"
set active-auth-method "ldap-scheme"
next
end
# config authentication settingConfigure firewall policies with LDAP authentication by selecting the explicit mode.
set active-auth-scheme "ldap-scheme"
end
# config firewall policyConfiguring User browser and validation.
edit 1
set type explicit-web
set explicit-web-proxy "web-proxy"
set dstintf "port1"
set srcaddr "9-42"
set dstaddr "all"
set action accept
set schedule "always"
set service "webproxy"
set groups "ldap-sslvpn"
set utm-status enable
next
end
Troubleshooting :
Useful debug command:
# diagnose debug application fnbamd -1
# diagnose debug enable
Then, run the below command on FortiProxy to verify whether user authentication working correctly with LDAP server or not.
# diagnose test authserver ldap <server_name> <username> <password>
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.