FortiOS local user authentication features

[eitten]

Hi guys,

we are planning to migrate a customer from a Cisco ASA to a Fortigate. I'm reviewing the ASA configuration to produce a feature compliancy check and I believe I found a specific feate my customer is using not supported by FortiOS.

VPN users are authenticated on the Cisco ASA using local authentication. The Cisco ASA is configured to release a specific IP address for each user and a specific "per user" ACL which sometimes is a single one shared and sometimes is very specific.

The desiderata is replicating the same behaviour on the Fortigate without using external authentication systems (Radius). If this is not possible (and I believe it's not), I would like to be sure that adding a pair of Radius hosts will solve the issue by allowing downloadable ACL and IP from the Radius servers other than simple authentication.

Searching hte KB I found this article showing that there's support for some specific VSA's, looks like Client-IP-Address is supported but I'm not pretty sure about downloadable ACL's. I can see a Fortinet-Access-Profile attribute but I'm not sure if that's what I really need.

http://kb.fortinet.com/kb/documentLink.do?externalID=13837

Anyone stumbled upon something similar already?

Thanks in advance.

-- EDIT --

Thinking about it I think it might be possible (but rather confusing) create a generic firewall policy for the VPN assigned IP-Pool,

specific ones for the clients that needs a different security posture (using the client IP address pushed by the radius server) and play with the policies order to let the Fortigate evaluate the specific ones before the generic one. It's ugly and not very maintainable but I'm not seeing any other way out at the moment.

-- EDIT --

[rwpatterson]

  SSL VPN specific:

When you set up the users, each one (or group) will have their own SSL VPN portal. This portal will carve out its own IP space. Using this space, you create a policy or group of policies allowing access to their allowed destinations. RADIUS is not the primary remote authentication mechanism using SSL VPN, but LDAP does work very well, and is widely used here. The ACL equivalent is the firewall policy. No download required, it's hard coded in the FGT.

Hope this helps

[eitten]

Hi, thanks for the quick reply. In the meantime I figure out that firewall policies is the only way to go instead of downloadable ACL:

-- EDIT -- Thinking about it I think it might be possible (but rather confusing) create a generic firewall policy for the VPN assigned IP-Pool, specific ones for the clients that needs a different security posture (using the client IP address pushed by the radius server) and play with the policies order to let the Fortigate evaluate the specific ones before the generic one. It's ugly and not very maintainable but I'm not seeing any other way out at the moment. -- EDIT --

Unfortunately we need IPSec VPN, not SSL. Are you aware of a possible workaround for IPSec VPN as well?

Thanks.

[emnoc]

OP yeah the ASA is very flexibile in regards to  group-policy and vpn-acl, but the fortigate does the same thing as what Bob has stated. I'm said to say it's ( FGT )  not as simple as the ASA.

I'm curious have up tried the forticonverter , and how does it handle vpn acl in a group policy? You should really try it and update fortinet TAC or Support on any limitations. I believe the forticonverter will not translate this correctly.

[eitten]

Hi, I tried the Forticonverter yesterday but I would rather code my own configuration from scratch. It's definitely good to give you a rough idea of what's going on and how it would do "something" according to Fortinet best practices but nothing more IMHO.

I reviewed the unconverted table log and I can confirm it ignores:

vpn-framed-ip-address

group-lock

vpn-filter

Those lines are associated with every user configured with local authentication on the ASA and are exaclty the features I'm missing (group-lock apart which can be replicated using the user group feature on FortiOS).

Thanks