Fortios 5.4 SSL VPN with RADIUS or LDAP authentication without local users?

[jbrashear]

Hello all,

I'm setting up 2 new 300D's running 5.4.  I have a working SSL VPN that I set up for testing, however that is using local accounts on the firewall.  I want to have all ssl vpn users authenticated against a RADIUS or LDAP server.  I was able to configure both on the Fortigate (LDAP and RADIUS servers and verified communication).  Where I'm running into a snag is how do I get the VPN to authenticate without a locally configured user account?  I don't want to set up 50 + accounts on the VPN. I just want it to see the inbound connection and then use the AD username and password supplied by the user to allow access.  This was very simple to do on my ASA.  I've found some stuff in the KB, etc, but nothing is very verbose for fotios 5.4.  Thanks in advance for any and all help.

JB

[Toshi_Esumi]

I haven't checked/done this with 5.4 but I wouldn't expect any significant difference. If you don't find any 5.4 specific documentation, the chances are there might be no change at all. You probably found below cookbook for 5.2:

http://cookbook.fortinet.com/ssl-vpn-radius-authentication/

Since you already have SSL VPN up, you care only Ch. 2 and 3. I would just try with a test user account. Make sure you test from the FG first before testing from a client device.

By the way, the cook book writers are quite responsive based on my experiences in the past. You might want to ask them why they don't have 5.4 version to know if no change.

[JayWinksInLine]

Surprised there's been no further discuss on this thread... I find no way to do this with LDAP. This was easy in older FortiOS. When I try to configure the policy, it does not show the FSSO or LDAP group as a choice.

[Toshi_Esumi]

I see group types at two running FGs with 5.2 and 5.4 are the same.

firewall        firewall fsso-service    Fortinet Single Sign-On Service. rsso            RADIUS based Single Sign-On Service. guest           Guest

Both units are currently running SSL VPN with a RADIUS server. Then firewall policy is using the group (type=firewall) for SSL VPN users in "set groups" statement. So I don't see any sign of changes between them.

[gsarica]

In response to Jay, you need to create a local 'User Group' and add an LDAP security group or users to that. Then you can add it to the policy.

[JayWinksInLine]

Yea I figured it out, the UI was just a bit different than what I was used to.

Thanks