Is it possible to raise the priority of RADIUS authentication in SSL VPN authentication rules?

[Houl]

Good day.

I'm struggling with next problem

We are using SSL VPN connection with two auth services LDAP and RADIUS (2FA thought FortiAuthenticator).

And we were surprised that FortiGate sends auth queries (according to authentication rules in SSL VPN configuration) simultaneously. It's f***** ridiculous.

My bosses cardinally against of using realms. They demand to use single URL.

Yes usually we don't have problems because use individual groups.

But we have several groups which must use 2FA but, if FAC will lay down, they have to use LDAP.

And without realms it's impossible to do auth rules configuration for these groups.

Is it possible to delimit users (without and with 2FA) with using single URL and without realms?

For example:

config authentication-rule
edit 1
set groups "User_Group_1_2FA"
set portal "User_Group_1"
set auth radius
next
edit 2
set groups "User_Group_2"
set portal "User_Group_2"

set auth ldap
next
edit 3

set groups "User_Group_1"
set portal "User_Group_1"
set auth ldap
next

end

[Toshi_Esumi]

How about separating policies and put the one with RADIUS/User_Group_1_2FA at the top?

Toshi

[Houl]

This doesn't work.

At first step SSL VPN deamon gets all groups from default realm and policies.

At second it sends simultaneously query to all auth services which were found in default realm auth rule.

After it uses the first answer from auth services. So... in this situation RADIUS will be always the last one.

[Debbie_FTNT]

Hey Houl,

I'm sorry to say that without realms to force authentication against specific groups, FortiGate will send the authentication request to all possible authentication servers based on SSLVPN policies as you have outlined above.
The intention behind it is to keep login latency low; if FortiGate checks one server after the other it would have to wait for failure/timeout each time and depending on setup, this could cause login wait times to quickly become ridiculous.
I agree that in cases such as yours the FortiGate design has limitations, but at present the only workaround FortiGate offers is using SSLVPN realms to ensure the user is only authenticated against very specific groups (and thus very specific authentication servers) instead of all.
Other than that, a feature request to allow designation of preferred authentication server or backup-only authentication servers might be an option, but feature requests need to be submitted via Fortinet Sales, that's not something I can do, my apologies.

Sorry for the bad news :(

[Toshi_Esumi]

Really? I need to test it myself then.

[Debbie_FTNT · Accepted solution]

I wrote a KB detailling how FortiGate goes about SSLVPN authentication: https://community.fortinet.com/t5/FortiGate/Technical-Tip-A-quick-guide-to-FortiGate-SSLVPN-authenti...

hope this answers any questions you might have :)

[Houl]

Thanks for full description!

[Houl]

Good day.

Could you provide more info about next resolved Bug in FortiOS 7.0.4. Does it mean that you fixed topic problem?

748085

SSL VPN authentication is not working for RADIUS users because the LDAP responds first.

[Debbie_FTNT]

Hey Houd,

the bug ID you referenced is a little more complicated as the topic makes it out. In greater detail - in the KB I wrote, I mentioned realms, and how specific user groups (and authentication servers) can be forced via realm selection. It was found that when users connect to the default realm (/), groups that are bound to specific realms are also considered for authentication.
With the fix, groups that are bound to specific realms are excluded from authentication against the default realm.

I will reach out to our documentation team to update the description to avoid confusion.

The basic function of SSLVPN authentication (against all possible servers at the same time) still remains.

[Houl]

Thanks for explanation!