LAN Connections

[brendonm11]

Hi All,

I'm the network administrator at a school. We recently got a Fortigate 30E device to control the network. 

I need help with the Fortigate. I'm struggling to create an IPv4 Policy to allow staff to access the internet all the time and disallow students to access the internet on certain times. 

I know how to do the scheduling and groups from the Active Directory. 

My concern, however, is that some staff members work on LAN connected devices... These LAN devices are not joined to the domain. 

By the IPv4 Policy when selecting the source, I select the source as Staff (from the Active Directory group) and NONE. When I apply the policy, LAN connected devices have no access to the internet... I have added their MAC and IP Addresses to the Custom Devices and added them to the policy as the source, but still no internet. 

Any help regarding this please??

Thanks in advance :) 

[ede_pfau]

hi,

for those devices which are not part of the AD domain you could

1- create local accounts and a local usergroup

and

2- set up a captive portal where users first have to authenticate via browser before they are allowed to use the internet.

FSSO via AD is quite convenient but by no means the only way to authenticate against a FGT.

[brendonm11]

If I do your method, would those PCs be required to logon often through Captive Portal?? Or can I set those users to be logged on for a long period (eg. a whole school term?)

[ede_pfau]

An important feature of the security provided by authentication is that it is temporary—a user must reauthenticate after logging out. Also if a user is logged on and authenticated for an extended period of time, it is a good policy to have them re-authenticate at set periods. This ensures a user’s session is cannot be spoofed and used maliciously for extended periods of time — re-authentication will cut any spoof attempts short. Shorter timeout values are more secure.

You set the security user authentication timeout to control how long an authenticated connection can be idle before the user must authenticate again. The maximum timeout is 1440 minutes (24 hours).

[brendonm11]

ede_pfau wrote:

An important feature of the security provided by authentication is that it is temporary—a user must reauthenticate after logging out. Also if a user is logged on and authenticated for an extended period of time, it is a good policy to have them re-authenticate at set periods. This ensures a user’s session is cannot be spoofed and used maliciously for extended periods of time — re-authentication will cut any spoof attempts short. Shorter timeout values are more secure.

You set the security user authentication timeout to control how long an authenticated connection can be idle before the user must authenticate again. The maximum timeout is 1440 minutes (24 hours).

Thanks!

These devices who aren't joined to the AD, are two PCs of the two secretaries... They won't really be happy to enter a password every day... :p 

So would you recommend me joining it to the domain?

I would definitely use this method for the students... So I can exactly pinpoint who's using how much data and what they are doing on the internet...

Currently my policy is to allow anyone to use the internet... :(

[romanr · Accepted solution]

Hey,

if it is to ease your setup:

 You can use a device policy for those 2 devices and set it before the authentication rules..

Have a look at:

https://docs.fortinet.com/uploaded/files/2804/fortigate-managing-devices-54.pdf

Br,

Roman

[Markus]

Why not fixing the IPs of the (only) two PCs and create a policy for them (source -> this two ips with no authentication). Then create the stundents policy as the method you wish. Place the secretaries policy BEVOR the stundents policy.