Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

Fortigate and Cisco ISE User based policy

Hi Guys,


I have an implantation which requires the fortigate to recognize a user when it is connecting to WiFi over dot1x. The radius server is Cisco ISE and the external ID I am using is an MS Active Directory. The whole communication between the client and the Cisco ISE happens over certificates, so all good here. Is it any way the fortigate to be able to see that and then perform a firewall policy based on user?


Many Thanks 

Contributor III

You could look at sending Radius accounting messages from the ISE server to the fortigate using RSSO.  When enabled, you will be able to send radius attributes based on user details in ISE and match them to a group in Fortigate.


If you have a large number of users connecting to the wifi, I would suggest using an FSSO server and send the radius messages to that instead of the fortigate direct.  This will greatly reduce the load on the Fortigate.  This article will show at the bottom how you can enable Radius accouting in the FSSO agent and then link the fortigate to the FSSO server to get the details:


Hope that helps!


Top Kudoed Authors