I need the authentication while using explicit-web-proxy.
The matter of fact is that obviously, it needs Kerberos authentication for authentication of AD-Users but in the documents on the given link below, by Fortinet, it didn't give us the picture clearly. I read the authentication document in which it defines all Kerberos authentication process.
Can I configure the FortiOS 5.6.x authentication settings on FortiOS 6.0, as I'm using this on Fortigate-VM 64 on evaluation period, or I need to set up the only Kerberos environment?
I want to know that is there any good guide or any video that can show us how to configure the process or do you have any kind of notes regarding this.
Hope to see your kind reply soon.
Thnks in advance.
Hi! I have 2 ADs, and configured for kerberos auth fortigate 200e on it. It's works. But I have the issue, in some app. I have response for ntlm auth., but internet works on PC. I type the creds of my AD user, and see log on fortigate-ntlm auth failed ,user NA. Somebody have any ideas
1. log in from browser first as most of the custom apps are politely said network hostile and do not handle even basic networking like port usage and releases properly. And authentication ... muhehe. MOst app don't do NTLM.
2. on FGT .. how about some basic networking / auth troubleshooting?
diag debug app fnbamd 7
diag debug auth -1
diag sniff pack any 'host <DC-IP> and port 88 or 389' 6 0 a ... or GUI packet capture towards DC
Kerberos should communicate on udp port 88 and DC LDAP by default on port 389. So check if you got ticket granted.
If your tokens are short and starts with T1R then those are NTLM (as 'negotiate' Auth method offer client ability to choose between NTLM and Kerberos token).
3. on workstation you can check if you do have a key via cmd: klist
I tried with certuil as you suggested, same string only separated evenly. Tried copy paste as is with "", and in one line, same error.
It is like FG don't even start "kerberos auth check process" because i can't see any traffic on TCP/UDP port 88.
Even with wrong keytab i would see some TCP/UDP 88 to AD.
Can I somehow get better debug from kerberos process ?
While testing keytab on linux with kinit, tcpdump showed "TCP 88" packets, and returned no error.
After checked with klist i can see ticket in linux so keytab must be ok.
Keytab was generated on W2016 AD.
Here is FG configuration of krb-keytab and ldap without passwords and keytab.
#configuration of krb-keytab and ldap.
# ldap test return success.
set server "192.168.0.10"
set cnid "cn"
set dn "dc=lo,dc=tr"
set type regular
set username "lo\\FortigateFirewall"
set password ENC lld.....
config user krb-keytab
set principal "HTTP/fortigate.lo.tr@LO.TR"
set ldap-server "ldap-kerberos"
set keytab "......................................................."
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.