FortiOS 4.00 & FSAE_Guest_Users

[noc]

Hi I have a Fortinet 50B with FortiOS V. 4.0.0 Build 0092, 090220 and using FSAE 3.00.37 New authentication rules called " Identity based policy" works fine with Windows AD, but we need also to allow navigation to " Guest" users in our network. FortiOs 4.0 has a new default group called " FSAE_Guest_Users" , but we dont know how to use. I put our configuration for some of you to help us (rule 1 and group auth " Usuarios Dominio" ). Thanks in advance config firewall policy edit 5 set srcintf " internal" set dstintf " wan1" set srcaddr " all" set dstaddr " all" set action accept set schedule " always" set service " DNS" next edit 4 set srcintf " internal" set dstintf " wan1" set srcaddr " all" set dstaddr " all" set action accept set schedule " always" set service " DHCP" set logtraffic enable next edit 1 set srcintf " internal" set dstintf " wan1" set srcaddr " all" set dstaddr " all" set action accept set fsae enable set disclaimer enable set identity-based enable config identity-based-policy edit 1 set groups " Usuarios Dominio" set logtraffic enable set profile " unfiltered" set schedule " always" set service " HTTP" " HTTPS" next edit 2 set groups " FSAE_Guest_Users" set logtraffic enable set profile " unfiltered" set schedule " always" set service " ANY" set traffic-shaper " shared-1M-pipe" next end next end config user group edit " FSAE_Guest_Users" set group-type directory-service next edit " Usuarios Dominio" set group-type directory-service set member " DOMINIO/SISTEMAS" " DOMINIO/USUARIOS" next end

[rwpatterson]

Here is my FSAE policy:

config firewall policy
     edit 77
         set srcintf " port1" 
         set dstintf " port2" 
             set srcaddr " <users_to_access_via_FSAE>" 
             set dstaddr " all" 
         set action accept
         set ippool enable
             set poolname " IP.pool.outbound"   
         set fsae enable
         set identity-based enable
         set nat enable
             config identity-based-policy
                 edit 2
                         set groups " High level Internet" 
                     set logtraffic enable
                     set profile " I/S" 
                     set schedule " always" 
                         set service " Allow.Default" 
                 next
                 edit 3
                         set groups " Medium level Internet" 
                     set logtraffic enable
                     set profile " general w unrated" 
                     set schedule " always" 
                         set service " Allow.Default" 
                 next
                 edit 4
                         set groups " Low level Internet" 
                     set logtraffic enable
                     set profile " general w/o unrated" 
                     set schedule " always" 
                         set service " Allow.Default" 
                 next
                 edit 1
                         set groups " FSAE_Guest_Users" 
                     set logtraffic enable
                     set profile " restrictive" 
                     set schedule " always" 
                         set service " Allow.Default" 
                 next
             end
     next
 end

Where " High level Internet" , " Medium level Internet" , " Low level Internet" , " FSAE_Guest_Users" are FSAE groups. " High Level Internet" gives maximum Internet access, and " FSAE_Guest_Users" Internet access is strictly limited access. The" FSAE_Guest_Users" is created on the FGT, and cannot be removed. This is the place to go when someone cannot be verified as logged into your network. This determines what will happen to them. Any policy below this with

         set srcintf " port1" 
         set dstintf " port2" 
             set srcaddr " <users_to_access_via_FSAE>" 
             set dstaddr " all" 

will never get accessed. Hope that helps.

[noc]

Hi ! Thanks, but it´s the same solution that we prove in our Fortigate. The fact is that Guest Users never go outside, and auth fail because FSAE tell' s they aren' t in any A.D. group. It seems as if this FSAE_Guest_Users group does not function well. We prove on HTTP and HTTPS services but also with ALL, and the result is the same: A.D Users navigate ok and guest users can' t. Thank' s