Anyone using FortiGate with RSA SecurID?

[InThePeg]

I have successfully setup our FortiGate with RSA SecureID for SSL VPN however I cannot have more then one type of SSL VPN portal (full access, web access etc). Fortinet explains that in order to have fortigate to communicate with the RSA SecurID server you must create a RADIUS connection (client) to your RSA Server. Then create a Local Group that uses RADIUS as a Remote Server. Under Remote Servers there is the ability to specify the Group in the RADIUS server but I cannot get this function to work. If I change the current value from " Any" to a specified DN all SSL authentication fails. Is there an attribute that my RSA server needs to send back to my fortigate? I know that some vendors have values that they are expecting back to perform validation. My use case is the following: If user A belongs in Group A they get the full access SSL page If user B belongs in Group B they get the web access SSL page Both users require 2 factor authentication with RSA SecurID. Help!

[Jeff_FTNT · Accepted solution]

Set up your RSA server support RADIUS VSA for Fortinet ############ VENDOR Fortinet 12356 BEGIN-VENDOR Fortinet ATTRIBUTE Fortinet-Group-Name 1 string ATTRIBUTE Fortinet-Client-IP-Address 2 ipaddr ATTRIBUTE Fortinet-Vdom-Name 3 string ATTRIBUTE Fortinet-Client-IPv6-Address 4 octets ATTRIBUTE Fortinet-Interface-Name 5 string ATTRIBUTE Fortinet-Access-Profile 6 string # # Integer Translations # END-VENDOR Fortinet ###### Send back " Fortinet-Group-Name " to FGT, FGT use it to do group match and match policy with different SSL VPN portal. Hope it is helpful.

[Jonathan_FTNT]

Hi Jeff,

Thanks. Do you have a step-by-step doc about the RSA configuration?

[Jeff_FTNT]

Sorry, I did not have it. I just use RSA server with Token.

But all Radius user should support VSA feature. Thanks

jo_FTNT wrote:

Hi Jeff,

Thanks. Do you have a step-by-step doc about the RSA configuration?

[Dinesh_FTNT]

Hi,

The below document will be helpful on configuring two factor with RAS ACE (Secure ID) servers (page-36).

http://docs.fortinet.com/...ate-authentication.pdf

[Shawn_W]

Thank you for the link.