Fortigate destination policy with user

[mmjo]

Hi.

We are using Cisco ISE with the pxgrid connector to fortimanager and that works fine.

but need to create fortigate policies with a user on both source and destination cause our cisco sda uses /19 subnets and seperated with sgt tags (pxgrid).

But when im trying to install a policy im only able to do source user, on destination there's no user tab.

Is that working as intended? cause then i need to have fortinet to make it work, out local fortinet team said it should work.

thx

Morten

[AEK]

Hi

I don't know such feature on FortiOS.

[smaruvala]

Hi,

Currently, this is not supported. We have a feature request but the feature is not available in any version yet. 

Regards,

Shiva

[pminarik · Accepted solution]

Actual user/group objects can only be used as a source-filter.

However, what about using a dynamic address object for your goal?
As far as I know, pxgrid is intergrated via FMG pushing the info to the FGT over the FSSO protocol.

For FSSO you should be able to create a matching address object:

type = dynamic

sub type = FSSO

FSSO group = <select your pxgrid group/tag>

The resulting address object should be selectable as a destination address in a firewall policy.

Have you tried this?

[mmjo]

Hi your a lifesaver, works like a charme.

Also better this way, then i dont need a ip subnet on the src and dst, the dynamic adress with the fsso/pxgrid group works.

thx

[AEK]

I love this solution. Didn't think about before.