Fortigate: Custom admin profile does not work

[htopcu]

Hello all,

an administration team need access to Fortigate firewalls. In general, they only need read-only access, but they should be able to disable and enable interfaces. I configured a new accprofile, where all options are set to read only, but the access control for network is set to read-write. When the user logs in, he gets prompted to choose between "Login Read-Only" and "Log Out", The user does not get any write access with the custom profile.

Implemented on a FG 101F, version 7.4.5.

Any ideas, what is wrong?

The relevant configuration:

config system accprofile

edit "net_admin"

set scope global

set comments

set secfabgrp read

set ftviewgrp read

set authgrp read

set sysgrp read

set netgrp read-write

set loggrp read

set fwgrp read

set vpngrp read

set utmgrp read

set wanoptgrp read

set wifi read

set cli-get enable

set cli-show enable

next

end

config system admin

edit "net-admin"

set accprofile "net_admin"

set vdom "DATA" "root"

set password ***

next

end

Kind regards, Hakan

[funkylicious]

does the user connect to a management ip from vdom DATA or root ?

is the FGT itself managed by FortiManager or FortiGate Cloud?

[dingjerry_FTNT]

Hi @htopcu ,

Is the account "net-admin" a local one or a remote one (I mean, authenticated via LDAP, Radius, TACACS+, and so on)? 

[Toshi_Esumi]

I created below admin profile and used it with a test admin account in my multi-vdom environment. But it works as I/you expected. Mine is 7.4.7. It might be a bag in 7.4.5. Open a ticket at TAC and ask them if it's a bag, which was fixed in either 7.4.6 or 7.4.7.

config system accprofile
  edit "test_admin"
    set secfabgrp read
    set ftviewgrp read
    set authgrp read
    set sysgrp read
    set netgrp read-write
    set loggrp read
    set fwgrp read
    set vpngrp read
    set utmgrp read
    set wifi read
    set cli-get enable
    set cli-show enable
  next
end
config system admin
  edit "test_admin"
    set accprofile "test_admin"
    set comments "test admin"
    set vdom "root" "test-vdom"
    set password ENC [password_hash]
  next
end

Toshi

[htopcu]

Hello all, thank you for your answers

@funkylicious 

does the user connect to a management ip from vdom DATA or root ?

-> The management IP ist configured on the root VDOM

is the FGT itself managed by FortiManager or FortiGate Cloud?

-> Yes, it is managed by Fortimanager

@dingjerry_FTNT 

Is the account "net-admin" a local one or a remote one (I mean, authenticated via LDAP, Radius, TACACS+, and so on)? 

-> Originally it is a RADIUS account, but I last tested it as a local user without RADIUS as mentioned with the shared configuration.

Please notice, that the RW access ist possible, when the user is linked to the super_admin profile, but do not get any RW access, when he is linked to the custom profile.

@Toshi_Esumi 

Thank you for your test. I will clarify whether an upgrade is possible in the short term and test again

[funkylicious]

hi,

i think that the reason is that the FGT is managed by FMG.

try moving the VDOMs that the user in question is trying to access to ADOMs in backup mode and then log in again.