Can't filter firewall policy based on user group

[raffaeledp]

Hello everybody, 

I have a firewall policy regarding an IPSEC tunnel.

This policy is saying that all the addresses that belong to ipsec_range can reach the internal destinations.

This policy, if I connect, is working fine:

I can reach on of  my VMs:

 

Everything is all right.

What's the problem?

The user that has connected to the tunnel, belongs to a group:

 

Let's suppose I  want to say:

I want to filter the source not only by ip address, but also by user group.

the same user has an address in ipsec_range and also belongs to IPSEC_USER.

Everything should be okay, right?

No! I can't reach my VM anymore. What am I doing wrong?

 

[HiralShah]

Hello @raffaeledp 

Can you please provide screenshot of your tunnel configuration? is it set to IKE mode  1 or 2?

That is expected behavior if you have xauth set to Auto server and User group mentioned in the ipsec dialup tunnel.

You can check below document: 

https://community.fortinet.com/t5/FortiGate/Technical-Note-FortiClient-Dialup-IPsec-VPN-Split-Tunnel...

[raffaeledp]

This is my configuration:

 

 

 

[HiralShah]

Hello @raffaeledp 

Thank you for sharing your configuration.

Then this is your expected behavior, if you want to use user group in the policy just select option inherit from policy in the XAUTH user group

[rsondal]

Hi,

are you using the same group under vpn tunnel configuration. you can follow below document for that. you need to use group either on policy or on tunnel configuration.

Using group based firewall policy for Dia... - Fortinet Community

Regards

Rakesh