Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
The_Nude_Deer
Contributor

FortiAuthenticator LDAP groups used on Fortigate

I have recently set up some SSL VPN Portals on a Fortigate, that are mapped to specific groups, the Fortigate is a Radius client from the FAC, The FAC uses LDAP to look up the user in AD, then looks at RSA for a token to authenticate the users.

 

All of the above is working abolutely fine, except for groups being passed to the Firewall to be used in the Portal mappings and Policies. I have to create a user on the Gate as a remote radius user, using the same name exactly that the FAC uses. this works... but some of the portals have 30-40 users. I had to create 30-40 individial users with the same name as the FAC.

 

Groups dont work in the same way, The documentation say you just create a Firewall Group with the same name on the Firewall, and make sure the FAC is sending the group-name attribute, which in my case it is., but it doesnt work, I have to switch back to using username. is this a bug?

1 Solution
ozkanaltas
Valued Contributor III

Hello @The_Nude_Deer ,

 

Group name is not important. The important thing is radius attributes and the Fortigate group name filter. The Radius Attribute and Fortigate group filter should be the same. Your configuration is like this right?

 

image.png

 

image.png

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW

View solution in original post

If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
10 REPLIES 10
ozkanaltas
Valued Contributor III

Hello @The_Nude_Deer ,

 

Actually, the group-name attribute should work. Can you share the Fortiauthenticator configuration as a screenshot with us? 

 

Also if you want to troubleshoot this issue, you can get a pcap file from a firewall for radius traffic. You can inspect the radius response FortiAuthenticator to FortiGate with this capture. If you can see the group attribute in the response packet Fortiauthenticator sends the group attribute but Fortigate can't process this attribute. 

 

Additionally, you can read this. It's the same thing you want. 

 

https://community.fortinet.com/t5/Support-Forum/How-to-filter-user-group-in-FortiAuthenticator/m-p/2...

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
The_Nude_Deer

Yes, I have done exactly what you have described in that thread, Create a Group on the FAC, added the remote users, gave it a name "phase1_test" , created a remote user group on the Gate with EXACTLY the same name and using remote radius server as the remote group, Fails every time, unless i add the exact username to the Firewall group as a remote user

 

I am unable to share, as its live production testing, but I have done exactly that

 

ozkanaltas
Valued Contributor III

Hello @The_Nude_Deer ,

 

Group name is not important. The important thing is radius attributes and the Fortigate group name filter. The Radius Attribute and Fortigate group filter should be the same. Your configuration is like this right?

 

image.png

 

image.png

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
The_Nude_Deer

Exactly like that...doubled checked it, it wont work, as soon as I add the user instead of the group it works

The_Nude_Deer
Contributor

i just removed the underscore in the radius attr and it worked? is that possible?

ozkanaltas
Valued Contributor III

Hello @The_Nude_Deer ,

 

I think it's not normal. Maybe there is a bug in your version. Which version do you use? 

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
The_Nude_Deer
Contributor

6.6.0 build 1617

ozkanaltas
Valued Contributor III

Hello @The_Nude_Deer ,

 

I didn't find anything (bug, known issue, etc.) about this. Maybe you can open a ticket to support services related to your problem. They can inspect the problem and respond to you.

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
The_Nude_Deer
Contributor

It wasn't a bug, the group name had "-" but the Radius Attribute had "_" Layer 8 Issue by me! 

Thank you

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors