FSAE Collector / DC Agent design for an extranet scenario

[gojj]

In a normal scenario we do not allow access from the outside, into our network. But due to change in our organization we need to expose at least one of our IIS web applications (with Integrated Authentication) from the outside, of course only after first a successfully authentication is made. We do not want to implement this in the ‘old’ scenario of DMZ with clone of the system and synching/replicating of system data… Therefore the Fortigate solution with FSAE does appeal. But I do need to take an implementation decision, perhaps somewhat based on my misunderstanding of the technique... Reading some of the documents I’ve collected informationthat I need at least: One installation (at least) of a FSAE Collector Agent and it does not need to be installed on a DC. So far OK. Then the documentation states that we need a FSAE DC Agent on all our DC. This is not OK, at least not in my administrator book. But hey it seems I do have some saying in the matter perhaps, there are two different modes: DC Agent mode and Polling Mode The DC Agent mode; the requiring it installed on _all_ DC in the domain or the Polling Mode; requiring non FSAE DC Agent installed at all. Ohh, there seems to be third option also. NTLM authentication, but only supported in IE and Firefox. Not OK, even if IIS integrated authentication ‘semi-requires’ IE so to speak. So Polling Mode seems nice. Let’s go with this for a moment: 1. Employee goes to https://extranet.domain.com (from their home computers, not associated with the company in any way) 2. Employee is meet with the Fortigate SSL-VPN login form 3. Employee provide their Windows AD username (without domain) and password 4. Fortigate receives the Windows AD username and password 5. Fortigate passes it to the FSAE Collector Agent 6. The Fortigate FSAE Collector Agent, with Polling Mode, asks the Windows AD DC’s is this information OK 7. The Windows AD DC’s responds, this login credentials is OK with its Windows AD Group membership (in this case) 8. The SSL-VPN portal page, with bookmarks, based on Windows AD Group membership is shown. 9. The Employee clicks one of the HTTP links 10. The HTTP link forwards the Employee to the IIS web application (with Integrated Authentication) and their login credentials to be authenticated with. 11. The employee is now logged on to the IIS web application (with integrated authentication) with the login information from [3.] and without their computes being within and/or member of the actual windows domain. There is of course many more decision to take late. But to finish this specific post: Is my option: at least one FSAE Collection Agent in Polling Mode will achieve my goal to allow employee to login with their windows login credentials and this also allow they to be automatic authenticated in IIS web applications? Am I missing something, do I need to provide some more information or anything else to make it easier for a design decision?