Hi All,
I have a scenario where I need to use the Explicit proxy and NTLM authentication. We are replacing another web proxy solution that is currently doing this. The authentication needs to be transparent and current is, so the browsers are configured to provide authentication responses already.
We are currently using FortiOS 5.4.
I have read some posts which seem to suggest that we require Fortigate/LDAP and FSSO - -but i am confused as to why we would need an FSSO collector in this setup.
Would the explicit proxy not just challenge the user browser and then based on the username returned perform an LDAP query to get the user/group membership details and then check the proxy policies?
Is an FSSO collector required in this setup and if so why?
Thanks, Moby.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
I think FSSO just make this much easier but I'm curious as to what you come up with? I believe www ntlm is supported now and in explicit proxy, I would love to see it working. We have the same requirement btw
Ken Felix
PCNSE
NSE
StrongSwan
Some config if it helps:
config user ldap edit "DC01" set server "10.10.10.10" set cnid "cn" set dn "dc=domain,dc=local" set type regular set username "domain\\user" set password ENC xxxxxxxxxxxxxxxxxxxx set port 3268 next end
config user domain-controller edit "domain.local" set ip-address 10.10.10.10 set domain-name "domain.local" set ldap-server "DC01" next end
config user group edit "SSO_Guest_Users" next edit "All Staff" set member "DC01" config match edit 1 set server-name "DC01" set group-name "CN=Domain Users,CN=Users,DC=domain,DC=local" next end next end
config authentication scheme edit "domain.local" set method ntlm set domain-controller "domain.local" next end
config authentication rule edit "domain.local" set srcaddr "all" set ip-based disable set active-auth-method "domain.local" set web-auth-cookie enable next end
Hi,
Thanks for the responses. James, do you have any FSSO polling at all? or are you just using the LDAP and domain controller configuration as you have shown?
I will see if I can get it working on 5.4.10 but if not then will upgrade to 6.0.4
Thanks, Moby.
No FSSO polling configured anywhere - just NTLM then LDAP lookup
Hi all,
James is actually using agentless NTLM (config user domain-controller), which is a new feature in 6.0 (it's there since 6.0.1 to be precise). Another possibility, besides of FSSO/NTLM or agentless NTLM solutions, could be Kerberos with explicit proxy, which is capable of NTLM fallback, if configured that way.
Fishbone)(
smithproxy hacker - www.smithproxy.org
Hi All,
I upgraded a test 60D to 6.0.4 and attempted to set this up, but it is not working so far so i expect I have done something wrong.
When testing using chrome browser and going to www,fortinet.com i get the error message "access denied the page you requested has been blocked by a firewall policy restriction"
I have attached some of my config below -- any ideas?
Thanks, Moby.
config user ldap edit "LDAPUK" set server "10.200.200.101" set cnid "sAMAccountName" set dn "OU=Mynet,DC=Mynet,DC=local" set type regular set username "CN=xxxxxx,OU=Global Users,OU=MyNET,DC=Mynet,DC=local" set password ENC hxxJicK2MzMgoi/h4U85ODrRDIyUSXVhgd2WfQyLtCBGcSkU0Au/IuQwZtjgqWa+bVPd68owRIbg8+YYsXLIpnrScnRlkoX/tz3K+xu6FkCq99mRq79729oz+eYuH3WxVRMum/qpGsum59RN2mvWU2lFBZ9WLjx/ihvBeMMtvZ0DBD9Z1mMnLa7VOqMxw6reHkYmIQ== next end
config user domain-controller edit "mynet.local" set ip-address 10.200.200.101 set domain-name "mynet.local" set ldap-server "LDAPUK" next end
config user group edit "SSO_Guest_Users" next edit "Guest-group" set member "guest" next edit "ALL_STAFF" set member "LDAPUK" config match edit 1 set server-name "LDAPUK" set group-name "CN=Domain Users,CN=Users,DC=domain,DC=local" next end next end
config authentication scheme edit "mynet.local" set method ntlm set domain-controller "mynet.local" next end
config authentication rule edit "mynet.local" set srcaddr "all" set ip-based disable set active-auth-method "mynet.local" set web-auth-cookie enable next end
config firewall proxy-policy edit 1 set uuid 7726beba-1f2a-51e9-6d4b-09ab9eb7ffed set proxy explicit-web set dstintf "wan1" set srcaddr "all" set dstaddr "all" set service "Proxy HTTP" "Proxy HTTPS" set action accept set schedule "always" set logtraffic all set groups "ALL_STAFF" next end
Hi Moby, config looks good, just custom services "Proxy HTTP" "Proxy HTTPS" look quite suspicious. Could you test with default "webproxy"?
Fishbone)(
smithproxy hacker - www.smithproxy.org
Hi Fishbone,
That is one thing i found that was strange - when i created the proxy policy it would not let me select any service. The only way I could select a service was to create new ones where the service type was "Explicit Proxy" then I was able to select them in the proxy policy - -see below from the CLI where i am editing the policy:
config firewall proxy-policy edit 1 set uuid 7726beba-1f2a-51e9-6d4b-09ab9eb7ffed set proxy explicit-web set dstintf "wan1" set srcaddr "all" set dstaddr "all" set service "Proxy HTTP" "Proxy HTTPS" set action accept set schedule "always" set logtraffic all set groups "ALL_STAFF" next end
FGT60D4613058466 (1) # set service *name Service name. Proxy HTTP custom Proxy HTTPS custom
The only ones available are those two that I created:
edit "Proxy HTTP" set proxy enable set protocol ALL set tcp-portrange 80 next edit "Proxy HTTPS" set proxy enable set protocol ALL set tcp-portrange 443
Moby
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1711 | |
1093 | |
752 | |
447 | |
231 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.