How to use IPsec user identity as the user identity for firewall policy?

[wkwkwk]

I am trying to achieve granular access control for each user, with strong definite unspoofable identity with IPsec user identity.

IPsec login uses user account, and by allowing each user to only access the network through IPsec, I thought I should able to let Fortigate know which traffic is from which user, and create firewall policies on each user. (ChatGPT told me it's doable on Fortigate that's the reason I bought it :loudly_crying_face::loudly_crying_face::loudly_crying_face:)

I have a Fortigate 60F on 7.2.8

After setting up a Remote IPsec connection, I found out IPsec identity is only good for IPsec login, but NOT for user traffic identification.

If Fortigate can associate the IPsec VPN traffic with the user identity used for IPsec login, so firewall rules can be applied, then it would be so powerful. But... it's not working.

In the FortiView Sources, after connecting, it just appears as a source with NO user identification, or MAC address, just a IP address. Applying Firewall rules to the user does nothing.

That is so frustrating. I've been trying to set it up for a couple of days, trying everything I could, searching, asking ChatGPT, but it's just not working.

Please help!!

Things I tried:

Remote IPsec tunnel Wizard with User name and password authentication set to native iOS login. But after connecting to the VPN, I found out Fortigate does not tag the traffic as user identifiable.

Then I set up the tunnel to use FortiClient, hoping thing are different, nope, still not tagging the user traffic.

Then I knew about ZTNA and FortiClient / FSSO metadata sending and EMS server, but it seems that it could cost more money and requires a dedicated server to run EMS. Which is out of my budget.

[wkwkwk]

I saw this post which have me hope that my setup would work but it's for version 5.0

Technical Note: Use of an Identity-based policy for the FortiClient IPsec VPN network access restriction

https://community.fortinet.com/t5/FortiClient/Technical-Note-Use-of-an-Identity-based-policy-for-the...

@rmetzger 

[yugulje]

If you look at authenticated users on the Gate, is user group listed next to user? FortiGate uses a VSA to pass and match group to user during radius auth. It needs this to use radius groups in policies.

[wkwkwk]

Thank you so much for replying!!

After connecting with IPsec, under Dashboard > Forticlient Monitor, Dashboard > Firewall User Monitor, no user or group was found. The user information is apparently only used as IPsec log in, but not identified for firewall use.

I created the user using User & Authentication > User Definition> Create New > Local User, with Username and Password. No RADIUS involved.

[GLOBAL]

Hello wkwkwk, the iPSec user are created locally in the Fortigate  and are not external i assume. In my setup we don't have IPSec for users and instead use SSL for that. I can have and do use policies controling a specific user group access to resources but that group is pulled from my ad server using LDAP. Unless your user base is mainly macbooks i believe you should already have an AD server of some type. Try to use LDAP to pull users created on it and controll the user group?