Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
InThePeg
New Contributor

Anyone using FortiGate with RSA SecurID?

I have successfully setup our FortiGate with RSA SecureID for SSL VPN however I cannot have more then one type of SSL VPN portal (full access, web access etc). Fortinet explains that in order to have fortigate to communicate with the RSA SecurID server you must create a RADIUS connection (client) to your RSA Server. Then create a Local Group that uses RADIUS as a Remote Server. Under Remote Servers there is the ability to specify the Group in the RADIUS server but I cannot get this function to work. If I change the current value from " Any" to a specified DN all SSL authentication fails. Is there an attribute that my RSA server needs to send back to my fortigate? I know that some vendors have values that they are expecting back to perform validation. My use case is the following: If user A belongs in Group A they get the full access SSL page If user B belongs in Group B they get the web access SSL page Both users require 2 factor authentication with RSA SecurID. Help!
1 Solution
Jeff_FTNT
Staff
Staff

Set up your RSA server support RADIUS VSA for Fortinet ############ VENDOR Fortinet 12356 BEGIN-VENDOR Fortinet ATTRIBUTE Fortinet-Group-Name 1 string ATTRIBUTE Fortinet-Client-IP-Address 2 ipaddr ATTRIBUTE Fortinet-Vdom-Name 3 string ATTRIBUTE Fortinet-Client-IPv6-Address 4 octets ATTRIBUTE Fortinet-Interface-Name 5 string ATTRIBUTE Fortinet-Access-Profile 6 string # # Integer Translations # END-VENDOR Fortinet ###### Send back " Fortinet-Group-Name " to FGT, FGT use it to do group match and match policy with different SSL VPN portal. Hope it is helpful.

View solution in original post

5 REPLIES 5
Jeff_FTNT
Staff
Staff

Set up your RSA server support RADIUS VSA for Fortinet ############ VENDOR Fortinet 12356 BEGIN-VENDOR Fortinet ATTRIBUTE Fortinet-Group-Name 1 string ATTRIBUTE Fortinet-Client-IP-Address 2 ipaddr ATTRIBUTE Fortinet-Vdom-Name 3 string ATTRIBUTE Fortinet-Client-IPv6-Address 4 octets ATTRIBUTE Fortinet-Interface-Name 5 string ATTRIBUTE Fortinet-Access-Profile 6 string # # Integer Translations # END-VENDOR Fortinet ###### Send back " Fortinet-Group-Name " to FGT, FGT use it to do group match and match policy with different SSL VPN portal. Hope it is helpful.
Jonathan_FTNT

Hi Jeff,

 

Thanks. Do you have a step-by-step doc about the RSA configuration?

Jeff_FTNT

Sorry, I did not have it. I just use RSA server with Token.

But all Radius user should support VSA feature. Thanks

jo_FTNT wrote:

Hi Jeff,

 

Thanks. Do you have a step-by-step doc about the RSA configuration?

Dinesh_FTNT
Staff
Staff

Hi,

The below document will be helpful on configuring two factor with RAS ACE (Secure ID) servers (page-36).

 

http://docs.fortinet.com/...ate-authentication.pdf

Shawn_W

Thank you for the link.

Labels
Top Kudoed Authors