Continuation of user authentication on mobile devices

[nsaito]

Access to the website was restricted using FortiGate user authentication.
There is no problem when connecting in an environment where the global IP address is stable, but when connecting with a mobile communication device, the session may be disconnected frequently and it will be necessary to re-authenticate the user. Is there any way to avoid this?

[adambomb1219]

How is the FortiGate learning of the IP to user mappings?  RADIUS accounting?  AD?  Something else?

[nsaito]

Thank you for contacting me.

We verified how to link with FSSO using Open LDAP and 389ds, but we confirmed that Fortigate does not support either of them. To avoid this using LDAP authentication, I think I would have to use Windows AD, but it would be difficult due to the cost, so I am looking for another method.

I haven't tried it yet, but is it possible to use FreeRadius?

best regards,

[adambomb1219]

You can ingest RADIUS accounting.  This wouldn't be function of FreeRADIUS though (unless it supports RADIUS Accounting relay)?  Otherwise, it would be up to your NADs.

[hbac]

Hi @nsaito,

Can you provide more details about the issue? Are you connecting a mobile communication device to wifi? Which authentication method are you using? 

Regards, 

[nsaito]

Hi hbac,

Thank you for contacting me.

Specifically, we verified using 389DS, but it was not supported by fortigate.
We do not use Wifi for communication, only mobile communication.
We have confirmed that this is caused by the inability to maintain sessions due to the frequent changes of IP addresses in mobile communications.

Here is a concrete example.
With Safari on the iPhone (same with other browsers), once Safari is moved to the background, the IP address often changes.
The target site is being accessed every minute, but when the browser moves to background processing, communication is interrupted and the session cannot be maintained.

I understand that fortigate treats the IP address as part of the auth, but is there a way to work around it?

best regards,

[Nchandan]

Hi team,

FortiGate uses session information to identify authenticated users. However, when using mobile communication devices, the IP address may change frequently due to factors like mobile data networks and dynamic IP assignment. This can result in a loss of session persistence.

[nsaito]

Thank you for contacting me.

I am having trouble because exactly this phenomenon is occurring.
I'm looking for a way to maintain sessions in an environment where IP addresses change dynamically.

I have confirmed that there is a way to use FSSO as a workaround, but it does not support Open LDAP or 389ds and seems to require the use of Windows AD. I think it would be difficult to introduce a new Windows AD server for this purpose due to the cost.

Is there any way to avoid this?

best regards,

[nsaito]

Hi Nchandan
Is there any way to avoid it?

best regards,

[Debbie_FTNT]

Hey nsaito,

you could probably use SAML authentication instead.

FortiGate does let you set up policies with SAML authentication: https://community.fortinet.com/t5/FortiGate/Technical-Tip-SAML-Authentication-for-Outbound-Firewall-...
SAML authentication works with cookies, so once your users have authenticated, their browsers should store the SAML cookie for a certain amount of time, and each time the FortiGate would ask to reauthenticate due to an IP change, the browser should present the SAML cookie with no action required from user, and the user should be authenticated on the new IP. The user would only be required to reauthenticate if either the browser cookies are deleted (closed a private window, cleared cache, rebooted) or the cookie expired.

The main point here is you would need some way to host user authentication on a SAML server; you could use Google Suite like in the KB, or another external provider (Microsoft for example). If you have a FortiAuthenticator, or are planning to purchase one, you can use that as a SAML server as well.