Kerberos Authentication Configuration

[KhizerSaleem]

Hi All,   I need the authentication while using explicit-web-proxy.   The matter of fact is that obviously, it needs Kerberos authentication for authentication of AD-Users but in the documents on the given link below, by Fortinet, it didn't give us the picture clearly. I read the authentication document in which it defines all Kerberos authentication process.    http://help.fortinet.com/...it%20proxy%20users.htm  

 Can I configure the FortiOS 5.6.x authentication settings on FortiOS 6.0, as I'm using this on Fortigate-VM 64 on evaluation period, or I need to set up the only Kerberos environment?

I want to know that is there any good guide or any video that can show us how to configure the process or do you have any kind of notes regarding this.    Hope to see your kind reply soon.   Thnks in advance.   Best Regards Khizer Saleem

[xsilver_FTNT]

Hi,

mentioned help doc is quite complex and should cover most of the usual configuration variants.

Basically said you have to decide between explicit/transparent proxy and ip-based/session-based authentication.

And then follow the steps for one of those four basic config variants.

Config is supposed to be same or very similar (not aware of any deviation) between 5.6 and 6.0 FortiOS.

You need those parts .

- LDAP server and group

- KRB keytab

- policy

- config authentication parts defining schedules/rules etc.

Kind regards, Tomas

[KhizerSaleem]

Hi,

Well, thanks Tomas for your kind reply, yes the document is too complex neither Fortinet made any video on their video library, so its too complex I tried all the things but don't know which thing is missing.

Thanks for your reply.

Best Regards

Khizer Saleem

[FortiBoris_FTNT]

Hey all, Doing some Kereros + Explicit Proxy testings on v6.0.4. Simple question, how is a user mapped towards multiple AD groups?? For the moment it seems i'm mapped to the 1st group alphabetically and not multiple groups. The idea would be multiple AD groups mapped to different Explicit Proxy rules each having different Web Filtering profiles applied. Although, we would want to have the possibility to map users within multiple groups, hence mapped to different Web Filtering profile (Social_Surfers, Sports_Surfers, Hacking_Surfers etc...). You add Bob within Social_Surfers group @AD and it dynamically can surf Social Networks on the fly while keeping it's previous surfing "rights" from say Sports_Surfers where he also belongs.

That scheme is possible with FSSO but couldn't reach my goal with Kerberos. User seems mapped to only ONE group while being members of more than one.

Thanks,

Boris

[KhizerSaleem]

Hi Boris,

You just have to make that users part of multiple AD-Groups, and then map that AD Groups in FSSO agent under Fabric Connector tab, and then map that FSSO objects in the groups.

After making groups, you can call them in multiple rules.

I used the proxy setup on 6.0.3 but with NTLM method(session-based) and it was more secure and feasible.

Regards

Khizer Saleem

[FortiBoris_FTNT]

Hey there Khizer, thanks for the update.. yes i saw that this is working with FSSO but wanted to achieve the same with Kerberos.. the FSSO polling agent at the FortiGate isn't supposed to scale at more than 200 users i think. hence the need for Kerberos.. cheers, boris

[KhizerSaleem]

Hi Boris,

No no, you are not clear on it. You can add 1000+ AD groups per single FSSO Object, and it's confirmed.

I consult the Fortinet TAC engineer while doing my project of the explicit web proxy. Unfortunately, I lost that table in which exact numbers were given, but I',m 100% sure it's feasible and secure too. 

Regards

Khizer Saleem

[KhizerSaleem]

Hi Boris

Forgot to mention that, always use the FSSO agent installed on Domain controller in the big AD environment.

For more assistance, you can contact me on my personal email, khizersaleem1992@gmail.com

Regards

Khizer Saleem

[KhizerSaleem]

Hi Boris

You are lucky, after searching for more than an hour, I finally got the table. Here is the link for your consideration.

https://help.fortinet.com/fgt/54/max-values/5-4-3/max-values.html

You can find the detail of AD Groups and FSSO Servers too.

Best Regards

Khizer Saleem

[FortiBoris_FTNT]

Hi,

Just for the feedback, this works perfectly with Kerberos and user is seen with "every" AD groups he's belonging in. You can check the user group mapping seen at FGT with those CLIs:

# diag debug enable # diag test app wad 2200 // 22xx (xx=process number) # diag test app wad 110

[1]     user:bob@FPOC.LAN@1.1.1.1(0x7f8d9089d1a0), type:SES, vf:0, ref:211, ntlm:0, has_fsae:0, guest:0                 user:1(0x7f8d912445a8), ip:1(0x7f8d913ad568), scheme=3, auth=yes, tfa=no, timeout:alive, id:1                 time: create=39(near=1) access=16 auth=101 traffic=1                 out_ip=0.0.0.0 out_ipv6=:: ftp_out_ip=0.0.0.0                 concurrent user limit: 65536 lifetime=39s, creation time:Mon Feb 25 12:04:52 2019     membership_type=1 number=2 srv/is_ldap=WIN-DC-LDAP/1:     [member 1 len=46]: cn=surfers_hackers,cn=users,dc=fpoc,dc=lan     [member 2 len=43]: cn=domain users,cn=users,dc=fpoc,dc=lan

Hence crafting explicit proxy rules toward different users groups works all fine.

Thanks

Boris