AD Group Authentication

[nsumner]

I have a SSL VPN setup and working well. My config is as follows (some information changed (obviously). NBNFG110C (ldap) # show config user ldap edit " LDAP_VPN" set server " 192.168.10.10" set cnid " samaccountname" set dn " DC=test,DC=lan" set type regular set username " CN=fortigate,OU=Admins,OU=test office,DC=test,DC=lan" set password ENC BLAH next end config user group edit " TEST-VPN" set sslvpn-portal " TEST" set member " LDAP_VPN" config match edit 1 set server-name " LDAP_VPN" set group-name " CN=VPN Access,OU=Security Groups,OU=groups,U=test office,DC=test,DC=lan" next end next end When I add the match as seen above some members of the group VPN Access are able to authenticate without a problem and others are blocked from logging in. It seems to be reliable in that some users are blocked and others are not! Have I done something wrong or am I hitting a bug of some sort?

[rwpatterson]

Are you certain that the FGT is aware of the users? Go to ' User > Monitor > Firewall' and see if they are seen as logged in, or if they appear as ' guest' .

[nsumner]

Okay under USer > Monitor > Firewall, I don' t see any users currently. If I go to the SSLVPN Monitor I currently see 3 users WITH usernames.

[rwpatterson]

Oh, SSL-VPN. Disregard my post. That' s for AD enabled web access. As far as SSL-VPN access, all users in the group should have equal access. Check to make sure you have enough unique IP addresses to allow all users in simultaneously. That' s the only thing I could think of.

[nsumner]

Yeah I' ve given the SSL VPN a class C and have about 40 SSL VPN users. So I should have plenty of IPs (and I' ve never looked and seen any where near that number of users connected). Plus I actually only get the error in the event that I try to limit the group... So I guess I will probably go ahead and open a ticket on this...

[nsumner]

I' m really at the point of being furious here. I opened a ticket at P3 level. According to this they should have responded already http://www.fortinet.com/doc/FortiCare_DS.pdf But of course 4 business days later and nothing. In fact my ticket doesn' t even appear to be assigned. Fortinet suppport has gone from pretty bad to nearly useless. I almost always get a first answer that seems to have ignored the information provided and than wait days! I' m mostly happy with the product but the support has become honestly useless... Common Fortinet clean up your act here!

[Glinski]

Hello Nsummer, Sorry to hear about your problem. I stumbled upon a similar problem. I created a security group in Active Group called SSL_VPN_Users and put the users in that group. Did all the settings in the Fortigate and it worked. Then there was this one user who couldn' t login. It turned out that the user, in Active Directory -> Properties on the user -> Member Of -> Primary Group was set to SSL_VPN_Users. As long as the user had his Primary Group set to SSL_VPN_Users and not to the default Domain Users he was not able to login. This is because the Primary Group does not show up during a LDAP query from the FortiGate, so the Firewall didn' t see that he was a member of SSL_VPN_Users. Edit: Are there any special characters in the samaccountname for the users that are having trouble? Noticed that FortiOS v.4 MR3 Patch2 and later don' t like certain language specifik characters. See attachment.jpg below.

[rwpatterson]

What firmware version are we talking here?

[Glinski]

Hi rwpatterson, When my SSL-VPN problem occured I do not remember what firmware it was on. But I do believe it was still on FortiOS v.4 MR2 Patch X. Regarding the FortiOS v.4 MR3 Patch2 and language specific characters we discovered we couldn' t point out source_address or destination_address. This was because we had special characters in the Firewall Objects -> Adress -> Name Another thing we noticed that I have not looked into (and has nothing to do with this thread) is that the our customer cannot see all users under User -> User The customer had about 40 manually created SSL-VPN Users here. And you could not see all of them. We have not looked into this matter since we created a Active Directory SSL-group instead.

[rwpatterson]

Are you still on version 3?