Fall through for a policy that works with Identity Based Policy and FSAE

[longwave]

Hi all, As I am relatively new to the subject, please ignore the simplicity of the question: We have a fortigate 110C with 4.0 MR1 Patch7. Recently we installed the FSAE package on our MS-domain controllers to be able to alllow/block access based on AD-users or AD-groups (that is at least what I understand what should be able). Now, if I configure a policy with the Identy Based Policy option activated, I can add a previously AD-group defined to have access to a certain service, for example HTTP/HTTPS. However, all other users not belonging to the selected group are blocked to the HTTP/HTTPS service, while my expectation would be a fall through to the next policy, which would give me the same way of working with IP-based policies. The group used in the Identity Based Policy option is a Directory Service group created through the User, User Group options that includes a group from the AD-server Thanks in advance.

[Kevin_Noble]

Just though I' d let everyone know the only solution to this was to create a rule above that has a group for all the services and allow that outbound without any identity polices enabled. The rules above were working OK - the reason it looked like rules above were being affected by the identity policy was that DNS from our servers was using the fall through policy so it was being cut off so it affected HTTP/HTTPS attempts from other workstations using the rules above. As soon as that was moved to a rule above with other protocols then things worked OK. It is not as convenient as the way it worked with the older 3.0 firmware which allowed for a fall through policy to be after the identity policies but it can be made to work if you manage to figure out all the protocols your workstations need for outbound traffic.

[longwave]

As a basic rule learned as a best practice I work down the policies as follows: 1. - policies based on IP-addresses/IP-networks, from specific to less specific. 2. - policies based on FSAE with various sub rules for the different groups. I place these policies just before the final DENY policy of an interface pair. 3. - DENY policy for the interface pair. In this way the IP-address policies are being handled as before without being interfered by the FSAE policies. That is, when you need to have that security. I am sure there will be offices working with FSAE policies only... Bye.