FortiADC Radius/Tacacs Admin Auth

[liddlei]

Hello

I'm trying to configure Radius/Tacacs authentication for admin/user access to the FortiADC. Version: 7.4.4 Build0347 (Mature)

I've created the radius server and a user account with the wildcard flag enabled.

Authentication is via Cisco ISE

This all works fine for super_admin access, users can authenticate and given full privilege's to all vdoms.

However, I'd like to have certain user only have read-only access to all vdoms.

I've created a read-only access-profile and an associated ISE policy-set sending the read-only group attributes, however, when a read-only user logs on, they are still given full super_admin access.

The usual command on something like a Fortigate 'set accprofile-override enable' is missing from the ADC CLI so I cannot add this to the wildcard user.

I'm assuming the user account with the wildcard flag cannot change the access profile without this.

Can anyone advise if what I'm attempting to do is available on the ADC?

And if not, is there a workaround or different configuration I can use to achieve the same result?

Thanks

[ashishrathee]

To configure read-only access for users on FortiADC version 7.4.4 using RADIUS/TACACS authentication, follow these steps:

1. Create a read-only access profile on the FortiADC: - Define the permissions for the read-only access profile to restrict users to view-only access.

2. Configure the RADIUS server (Cisco ISE) to send the appropriate attributes for the read-only group: - Ensure that the RADIUS server is configured to send the correct attributes for the read-only group membership and access profile.

3. Assign the read-only access profile to the users: - Associate the read-only access profile with the specific users who should have read-only access.

4. Verify the configuration: - Test the login of a read-only user to confirm that they are only granted read-only access as intended.

Since the "set accprofile-override enable" command is not available on FortiADC, you may need to ensure that the RADIUS server is sending the correct attributes to enforce the read-only access profile for the users. Double-check the attribute settings on the RADIUS server to ensure they align with the read-only access profile on the FortiADC.

By correctly configuring the access profiles on the FortiADC and ensuring the RADIUS server sends the appropriate attributes, you should be able to achieve the desired read-only access for specific users on all VDOMs.

[liddlei]

Hi, thanks for the response

However, I'm still having issues with this.

I've followed the steps provided, but without having an Administrator account with the wildcard flag enabled, the auth request is never sent to ISE in the first place.

The steps I've followed are below:

1. In the Root VDOM I've added the Radius server (Cisco ISE) details under User Authentication --> Remote Server

Test Connectivity button is successful.

2. In Global VDOM, System --> Administrator --> Access Profile, Created a new Access Policy called 'read_only' with only read attributes set for all.

3. In Global VDOM, System --> Administrator --> Access Profile, Created a new Access Policy called 'no_access' with none set for all.

4. In Global VDOM, System --> Administrator --> Admin, Created a wildcard user called 'radius_auth'

Name: radius_auth

Global Admin: No

Administrator Profile: no_access (Created in step 3)

Virtual Domain: Added all VDOMs

Authentication Type: Radius

Radius Server: Added the radius server created in Step 1

Wildcard: Enabled

ISE Config

1. Imported Fortinet VSA's, specifically:

Fortinet-Group-Name	1	String
Fortinet-Client-IP-Address	2	IP address
Fortinet-Vdom-Name*	3	String
Fortinet-Client-IPv6-Address	4	Octets
Fortinet-Interface-Name	5	String
Fortinet-Access-Profile	6	String

2. Created an Authorization Profile called 'Fortinet_RO'

3. Profile set to:

Access Type: ACCESS_ACCEPT

Fortinet-Access-Profile = read_only (Access Profile created in Step 2)

4. Added a policy set to identify read-only users and have them authenticate against the 'Fortinet_RO' authorization policy.

I also have a full-access profile for administrators with an authorization profile 'Fortinet_RW'

When testing, I basically get whatever access has been set on the wildcard admin account.

e.g. if 'radius_auth' admin account is set to 'no_access', no matter who logs on, they get no access to anything

if 'radius_auth' admin account is set to 'read_only', no matter who logs on, they get read_only access to anything

if 'radius_auth' admin account is set to 'super_admin_prof', no matter who logs on, they get full access to anything

Authentication is coming to ISE as I can see a successful attempt in the logs and it is sending the read_only access attributes back if read-only user or admin if admin user.

I think the issue is without the "set accprofile-override enable" command being available, the ADC is unable to change the access-profile when the authenticated user logs on.

Can you please advise if this is the correct set up as outlined above or if I'm missing a step please?

Also is the Fortinet-Access-Profile = read_only the correct attribute and am I missing anything I need ISE to send to the ADC?

Thanks