Chromebook login identification

[tiger2]

Not sure if this is the correct section.

I work for an educational organization that is slowly transitioning from Windows based local systems to Google GAFE. As part of the process we have deployed a large batch of shared Chromebooks for the students to use. Our primary gateway is a Fortigate 300D and I'm very pleased with it's performance.

The issue I have is that it seems currently impossible for the Fortigate to identify the users logged in to the Chromebook (it will report source IP and MAC). As a stopgap measure I've moved all Chromebooks to their own VLAN and applied the student security profile on it. However, this will also block any sites allowed for staff using the Chromebook. This is not an optimal solution.

I have the occasional need to identify individual users who break policy for security reasons.

Is the Fortigate capable of doing this?

[xsilver_FTNT]

guess they connect via WiFi, so what about WPA2-enterprise auth against RADIUS (might be FAC or NPS on AD) and then RSSO and group membership per logon to FortiGate and then Identity based policies using group membership knowledge ?

So teachers/stuff will be in different group then users/students .. so it will not be per device identity but per user (probably better as you mentioned that Chromebooks are shared => making it harder to decide who is user).

For more about RSSO/WSSO check cookbook.fortinet.com for receipts.

[tiger2]

This is an option, but I want to avoid double authentication.

The problem is that the GAFE and AD accounts are different in setup and entirely separate (this is a project for a later date). I have RSSO working (sortof, the Fortigate doesn't identify users properly yet) for a different wireless network.

With your solution a user would have to connect to the wifi first, auth, and then log in to their google account. Right now all wireless settings (simple WPA2 PSK) are pushed to the Chromebooks so the students only need to sign in once.

I'd much rather the Fortigate pick up the google account login and log it to the Chromebook device IP/MAC. It can already restrict logins to certain domains, so there seems to be a way to filter that info out.

[xsilver_FTNT]

I have no personal experience with Chromebooks. If you can somehow collect logons (RADIUS Accounting, syslog, or even those Exchange email logons .. ) FSSO Collectors can utilize many sources and make FSSO records based on those data and so pasively authenticate user's traffic without any necessity for user active logon.

Or you can utilize their logon to WiFi via RSSO, so users will be appear in logs on FortiGate/FortiCloud/FortiAnalyzer with their wifi logons and not with google accounts, devices should be recorded by their MAC address kind of uniquely identifying devices.

But I do not know your environment deep enough for more precise advise.

[tiger2]

Chromebook logins can't utilize FSSO as these are essentially GMail logins. I don't think there's a way to parse login info from Google's end. I know records are kept, but it's pretty obtuse to get them.

The issue seems to stem from a design perspective that a device is assigned to a user and therefor shouldn't require detailed users per device logging. I may have to look at a 3rd party solution.

[Carl_Windsor_FTNT]

It is possible to Authenticate the users onto the network using the FortiAuthenticator and the Social Auth feature using Google Credential SSO.  There is a cookbook on this topic here  http://cookbook.fortinet.com/social-wifi-captive-portal-fortiauthenticator-google/

[tiger2]

Carl Windsor wrote:

It is possible to Authenticate the users onto the network using the FortiAuthenticator and the Social Auth feature using Google Credential SSO.  There is a cookbook on this topic here  http://cookbook.fortinet.com/social-wifi-captive-portal-fortiauthenticator-google/

This looks to show a solution in part. We do not have a FortiAuthenticator and I don't think there's budget to add one.

[mfahey]

I have also expressed this lack of functionality in the content filtering to fortinet. It has fallen on def ears.

FSSO simply put is "windows devices only". 

They will try to push the solution off into using other technologies such has fortiauthenticator or wpa2 enterprise.

They will also try to suggest their Forticlient EMS which has nothing to do with content filtering user identification.

EVERY other Content Filter has a windows app, mac app (dmg) or chrome extension that does user identification and its free.

Most environments in 2017 are a mixure of devices be it windows,mac , chrome ,android ,etc.

If the Admin can't run a report for "Jsmith" because they are using a chromebook, then Fortinet Content filtering and reporting has failed me and is useless.  

The bottom line is due to lack of features like this Fortinet Content filtering is not education friendly.