IPSec VPN and Device Identification

[mhodgdon]

I have an issue which I' m hoping someone could lead me in the right direction to fix. We have a FortiGate 100D with 42 FortiWifi 20C/40C' s connecting to it via an IPSec VPN Tunnel. We just started using Web Filtering/Application Control to restrict access to certain web sites and applications for our employees, but we are an organization that serves adults with disabilities in group home settings. Some of these individuals have computers/tablets/smartphones/etc. and connect to a wifi connection that we deploy with a basic password so they can connect and get on the web. Unfortunately the password for that wifi connection was shared with some employees who now connect there personal phones and could get on sites/applications we didn' t want them using during there shifts. As of right now no devices can get to social media, but we want to allow the individuals to get on. My thought process for a solution was to allow these devices (using MAC Addresses) to use a different policy with different security profiles which I' ve done at our main office (where the FortiGate 100D is) but the MAC addresses for devices aren' t being passed over the VPN and I' m not sure if it is even possible for that to happen and if so I' m missing where to let that happen. Does anyone have anything that can lead me in the right direction or maybe this isn' t possible at all? Thanks!

[emnoc]

You could have solved this by setting up 2 SSIDs one for guest with policy ABC and one for Employees with XYZ Now this would not prevent a employee sharing his/her PSK to a guest. What you need to do is review fortigate review of BYOD and protections of resources. They a few papers and videos about how to tackle this. Google BYOD and fortinet. You could manage this via network logins controls within a captive environment.

[ede_pfau]

All is not lost. hi, I can see why you would want to keep access to the WiFi via password and not via captive portal. So this should be held constant in a future solution. Second, sharing a password is never a good idea. Even if you would change the WiFi password now you wouldn' t have any guarantee that it would not be leaked in the future. So you will have to use the new (FortiOS v5) device recognition feature to discriminate your employees phones in order to apply different web filter profiles. Fortunately, you are using FortiWiFis as local APs and VPN gateways. I am assuming that these remote FGTs are used " as is" , i.e. not as remotely managed APs. In this case you would enable device recognition on the FortiWiFis which would enable you to enable two user groups to use different firewall policies, namely policies between " internal" and " VPN" . You would set up the device groups as sources which would make 2 policies available, one for users and one for employees. Here you could lead them through different VPN tunnels to your central FGT where the UTM takes place (web filter, schedules etc.). Does that sound like what you intend? Do you think it could work this way? I know this scheme does have a drawback, namely having 42x2 device groups to manage. At this point you should consider getting a FortiManager to handle your FGTs, policies and all that.