Active Directory authentication does not work

[Ivanildo_Galvao]

Hello friends, okay? I'm setting up a 60D FGT on a client and is almost ready, what is missing is the navigation out with authentication in Active Directory, I have done the settings following this video

[link]https://www.youtube.com/watch?v=WopByyq1rTI[/link] Unfortunately it did not work, I realized that when creating the rule, which does not have the option of Policy Type and Subtype, where then we can specify the domain user groups, as I did not see this, then put originates from the LAN network and a the field of the groups, but did not work. They can give me guidance? I must go back Thursday on the client and leave the authentication in running Active Directory. I want to create 03 rules, they are:

a. One with Webfilter restricting categories - domain users

b. Another without Webfilter and without App Control - to the Board

c. One with access to social media, videos, etc., but only at lunch - for domain users.

Thanks

Ivanildo Galvão

[NotMine]

Hi,

If I understood correctly, you've done the following:

[ol]

Bound the LDAP server (AD).

Configured FSSO on the FortiGate.

Created a Fortinet Single Sign-On (FSSO) user group.[/ol]

But you have a problem because, in the newer versions, FortiOS does not have firewall policy types and subtypes. That's OK. All you need to do is:

[ol]

Create a new policy.

For your Incoming interface, select your LAN interface.

For the Source Users(s), select your SSO user group.

For the Outgoing interface, select your WAN interface.

Configure web filtering and other aspects of the policy, as necessary.[/ol]

Hope this helps!

[Huey]

Does the account used for querying AD need to be a domain admin or otherwise elevated account?  I've performed all the steps using a regular account for AD query.  This works as far as use lookups are concerned but the policy I created to test with does not allow access based on AD users or groups.

[Christopher_McMullan]

The account used to query AD for FSSO needs to be a domain or forest admin.

[Huey]

Thanks. I made that change but it still isnt working. FG support tells me that the way it works is by the FG polling the event logs on the domain controller. They said that it is watching for eventid 672 which is the kerberos ticket request by the client. Made sure my logon server was the one monitored. But watching the event logs I didnt see any 672 event ID's on the DC for my login. Tried logging out/logging in but still no 672. Not sure why. I see them for other users. Read in anotherthread that the agentless FSSO is really for very small environments. I've yet to confirm that but it makes sense. The Windows security event log is pretty busy in my environment with over 200 users and a couple of hundred systems hitting AD. May go with the agent based FSSO if I dont get any love from support...

[tcprado]

I have the Fortigate SSO Agent installed and it is still not working. I get the logon events in the agent logs but when the user tries to connect to the internet it does not go through the policy I set for that user group.

[Huey]

Did you install on every domain controller?