- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can't filter firewall policy based on user group
Hello everybody,
I have a firewall policy regarding an IPSEC tunnel.
This policy is saying that all the addresses that belong to ipsec_range can reach the internal destinations.
This policy, if I connect, is working fine:
I can reach on of  my VMs:
 
Everything is all right.
What's the problem?
The user that has connected to the tunnel, belongs to a group:
 
Let's suppose I  want to say:
I want to filter the source not only by ip address, but also by user group.
the same user has an address in ipsec_range and also belongs to IPSEC_USER.
Everything should be okay, right?
No! I can't reach my VM anymore. What am I doing wrong?
 
Solved! Go to Solution.
- Labels:
-
Firewall policy
-
FortiClient
-
FortiGate
-
IPsec
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
are you using the same group under vpn tunnel configuration. you can follow below document for that. you need to use group either on policy or on tunnel configuration.
Using group based firewall policy for Dia... - Fortinet Community
Regards
Rakesh
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello @raffaeledp
Thank you for sharing your configuration.
Then this is your expected behavior, if you want to use user group in the policy just select option inherit from policy in the XAUTH user group
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello @raffaeledp
Can you please provide screenshot of your tunnel configuration? is it set to IKE mode 1 or 2?
That is expected behavior if you have xauth set to Auto server and User group mentioned in the ipsec dialup tunnel.
You can check below document:
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is my configuration:
 
 
 
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello @raffaeledp
Thank you for sharing your configuration.
Then this is your expected behavior, if you want to use user group in the policy just select option inherit from policy in the XAUTH user group
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you so much, you helped me a lot!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
are you using the same group under vpn tunnel configuration. you can follow below document for that. you need to use group either on policy or on tunnel configuration.
Using group based firewall policy for Dia... - Fortinet Community
Regards
Rakesh
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you very much!
