Fortinet Identity-Based Policy Setup – Multiple AD Groups

[Zaheerudin45]

Hello,

I’m working on a project where FortiGate is integrated with Active Directory using FSSO. I’ve successfully retrieved AD groups such as Basic-Access,Whatsapp-Access, and Anydesk-Access.

Requirement:

• Users in the Basic-Access group should have basic internet access (with restrictions such as blocking social media,whatsapp,youtube).

• If a user is also part of Whatsapp-Access (in addition to Basic-Access), they should retain the Basic-Access permissions but also gain the ability to use WhatsApp.

• The client wants full control from AD, so we should only add/remove users from groups without making changes on the firewall.

Issue I’m facing:
The problem comes down to policy order.

• If I place the Whatsapp-Access policy above Basic-Access, a user in both groups only matches the Whatsapp policy and ends up with WhatsApp only (all other traffic blocked).

• If I reverse the order, then the Whatsapp policy is never hit, and the user only gets Basic-Access.

So effectively, the firewall only applies the first matching policy and ignores the next, which prevents combining permissions.

Question:
How can I design this so that a user keeps Web-Access permissions while also gaining additional access (like WhatsApp) when added to another AD group?

• Is this achievable with identity-based policies?

• Or is there another recommended design approach for this use case?

For reference, current setup:

• Basic-Access Policy: All services allowed except Social Media, Audio & Video, WebChat(whatsapp) using web filter.

• Whatsapp-Access Policy: Web filter and Application Control blocks everything except “WebChat(Whatsapp)”
  
  

[AEK]

Hi Zaheer

In the WhatsApp-Access app control profile, you need allow both WhatsApp application and the basic access applications as well. You can duplicate the Basic-Access app ctrl and add WhatsApp allowed as exception.

[Zaheerudin45]

Thanks @AEK for Response,

 I’ve tried the suggested approach but hit a new challenge.

Current Setup:

• FortiGate integrated with AD via FSSO.

• Groups: Basic-Access, Whatsapp-Access, Anydesk-Access, FB-Access, etc.

• Each group has its own firewall policy with source set to the respective AD group.

• For each “special access” group, I duplicated the Basic-Access WebFilter/AppControl profile and added the specific service/application (e.g., WhatsApp, Anydesk, or Facebook).

Example:

• Allow-Anydesk Policy → Basic-Access + Anydesk allowed.

• Allow-WhatsApp Policy → Basic-Access + WhatsApp allowed.

• Allow-FB Policy → Basic-Access + Facebook allowed.

The Issue:
If a user (e.g., xyz) is added to multiple groups (say, Whatsapp-Access and Anydesk-Access), the firewall only applies the first matching policy in order.

• If Allow-Anydesk policy is on top → user gets Basic + Anydesk, but WhatsApp is still blocked.

• If Allow-Whatsapp is on top → user gets Basic + WhatsApp, but Anydesk is blocked.

So effectively, policies don’t merge permissions — only the first match is applied.

Requirement:
Users should inherit Basic-Access by default and gain cumulative access when they are added to multiple AD groups (e.g., WhatsApp + Anydesk + FB, depending on group membership).

Question:

• Is there a way to combine permissions across multiple identity-based policies instead of being limited to the first match?

• Or is the only option to manually create combined profiles for every possible combination (which doesn’t scale well with many groups)?

• Is there a recommended design pattern to achieve this more cleanly in FortiGate?

[AEK · Accepted solution]

Hi Zaheer

I think two solutions are possible in this case:

1. Put the more privileged policies at top
2. Use policy based VDOM instead of profile based VDOM. This is more havy change but it has another way to manage app ctrl that allows you do what you need