Explicit Proxy and NTLM

[moby]

Hi All,

I have a scenario where I need to use the Explicit proxy and NTLM authentication. We are replacing another web proxy solution that is currently doing this. The authentication needs to be transparent and current is, so the browsers are configured to provide authentication responses already.

We are currently using FortiOS 5.4.

I have read some posts which seem to suggest that we require Fortigate/LDAP and FSSO  - -but i am confused as to why we would need an FSSO collector in this setup.

Would the explicit proxy not just challenge the user browser and then based on the username returned perform an LDAP query to get the user/group membership details and then check the proxy policies?

Is an FSSO collector required in this setup and if so why?

Thanks, Moby.

[emnoc]

I think FSSO just make this  much easier  but I'm curious as to what you come up with? I believe www ntlm is supported now and in explicit proxy, I would love to see it working. We have the same requirement btw

Ken Felix

[James_G]

Hi, I configured an explicit proxy with ntlm auth today, works really well. I have 6.0.4 on the unit I was testing this with, any chance you are going to upgrade? The reason I went for ntlm was I'm using a citrix environment and fsso dc polling cannot identify users without extra agent software on hosts, I would rather no agent.

[James_G]

Some config if it helps:

config user ldap edit "DC01" set server "10.10.10.10" set cnid "cn" set dn "dc=domain,dc=local" set type regular set username "domain\\user" set password ENC xxxxxxxxxxxxxxxxxxxx set port 3268 next end

config user domain-controller edit "domain.local" set ip-address 10.10.10.10 set domain-name "domain.local" set ldap-server "DC01" next end

config user group edit "SSO_Guest_Users" next edit "All Staff" set member "DC01" config match edit 1 set server-name "DC01" set group-name "CN=Domain Users,CN=Users,DC=domain,DC=local" next end next end

config authentication scheme edit "domain.local" set method ntlm set domain-controller "domain.local" next end

config authentication rule edit "domain.local" set srcaddr "all" set ip-based disable set active-auth-method "domain.local" set web-auth-cookie enable next end

[moby]

Hi,

Thanks for the responses. James, do you have any FSSO polling at all? or are you just using the LDAP and domain controller configuration as you have shown?

I will see if I can get it working on 5.4.10 but if not then will upgrade to 6.0.4

Thanks, Moby.

[James_G]

No FSSO polling configured anywhere - just NTLM then LDAP lookup

[Fishbone_FTNT]

Hi all,

James is actually using agentless NTLM (config user domain-controller), which is a new feature in 6.0 (it's there since 6.0.1 to be precise). Another possibility, besides of FSSO/NTLM or agentless NTLM solutions, could be Kerberos with explicit proxy, which is capable of NTLM fallback, if configured that way.

Fishbone)(

[moby]

Hi All,

I upgraded a test 60D to 6.0.4 and attempted to set this up, but it is not working so far so i expect I have done something wrong.

When testing using chrome browser and going to www,fortinet.com i get the error message "access denied the page you requested has been blocked by a firewall policy restriction"

I have attached some of my config below -- any ideas?

Thanks, Moby.

config user ldap edit "LDAPUK" set server "10.200.200.101" set cnid "sAMAccountName" set dn "OU=Mynet,DC=Mynet,DC=local" set type regular set username "CN=xxxxxx,OU=Global Users,OU=MyNET,DC=Mynet,DC=local" set password ENC hxxJicK2MzMgoi/h4U85ODrRDIyUSXVhgd2WfQyLtCBGcSkU0Au/IuQwZtjgqWa+bVPd68owRIbg8+YYsXLIpnrScnRlkoX/tz3K+xu6FkCq99mRq79729oz+eYuH3WxVRMum/qpGsum59RN2mvWU2lFBZ9WLjx/ihvBeMMtvZ0DBD9Z1mMnLa7VOqMxw6reHkYmIQ== next end

config user domain-controller edit "mynet.local" set ip-address 10.200.200.101 set domain-name "mynet.local" set ldap-server "LDAPUK" next end

config user group edit "SSO_Guest_Users" next edit "Guest-group" set member "guest" next edit "ALL_STAFF" set member "LDAPUK" config match edit 1 set server-name "LDAPUK" set group-name "CN=Domain Users,CN=Users,DC=domain,DC=local" next end next end

config authentication scheme edit "mynet.local" set method ntlm set domain-controller "mynet.local" next end

config authentication rule edit "mynet.local" set srcaddr "all" set ip-based disable set active-auth-method "mynet.local" set web-auth-cookie enable next end

config firewall proxy-policy edit 1 set uuid 7726beba-1f2a-51e9-6d4b-09ab9eb7ffed set proxy explicit-web set dstintf "wan1" set srcaddr "all" set dstaddr "all" set service "Proxy HTTP" "Proxy HTTPS" set action accept set schedule "always" set logtraffic all set groups "ALL_STAFF" next end

[Fishbone_FTNT]

Hi Moby, config looks good, just custom services  "Proxy HTTP" "Proxy HTTPS" look quite suspicious. Could you test with default "webproxy"?

Fishbone)(

[moby]

Hi Fishbone,

That is one thing i found that was strange - when i created the proxy policy it would not let me select any service. The only way I could select a service was to create new ones where the service type was "Explicit Proxy" then I was able to select them in the proxy policy - -see below from the CLI where i am editing the policy:

config firewall proxy-policy edit 1 set uuid 7726beba-1f2a-51e9-6d4b-09ab9eb7ffed set proxy explicit-web set dstintf "wan1" set srcaddr "all" set dstaddr "all" set service "Proxy HTTP" "Proxy HTTPS" set action accept set schedule "always" set logtraffic all set groups "ALL_STAFF" next end

FGT60D4613058466 (1) # set service *name Service name. Proxy HTTP custom Proxy HTTPS custom

The only ones available are those two that I created:

edit "Proxy HTTP" set proxy enable set protocol ALL set tcp-portrange 80 next edit "Proxy HTTPS" set proxy enable set protocol ALL set tcp-portrange 443

Moby