LDAP and RADIUS

[kamil]

HI

I have configuration where I have few groups with LDAP authorization and few groups with RADIUS authorization. 

I noticed that when I used LDAP group to VPN connection my Microsoft NPS with Radius server got request about user. This request is rejected. User established connection and in logs on my vpn device I see that this user is authentication with LDAP group. 

If in NPS network policy I added group for this user I got MFA prompt when try establish vpn connection. If do nothing and wait user will be connected to sslvpn. On NPS I see rejected access but on logs in fortigate i see user used ldap groups. 

Why fortigate device send request to NPS server if user is only in group which is assigned to LDAP server?

(NPS is installed on DC, LDAP and NPS have this same IP)

[xsilver_FTNT]

Hi,

don't you have mixed user groups of LDAP and RADIUS type, or multiple groups in VPN rules ? don't you have RADIUS server with 'set all-usergroup' so it is actually hidden member of ALL the user groups ? what kind of VPN do you refer to ? as IPSec auth is different to SSL VPN. maybe some debug you tried, probably fnbamd 7 outputs and vpn ones like ike debug for IPSec ?

I would start the troubleshooting with those questions/answers as your problem description is quite wide.

[kamil]

Hi

Add more comments about configuration:

I configured VPN FortiGate with Radius + Azure MFA, but few groups still use LDAP configuration. Problem which appeared last time is: If user is in radius group, did not confirm or reject MFA prompt his connection is established and user is assigned to one of LDAP group in FortiGate. If confirm MFA - is assigned to correct group. In logs on NPS I see that connection is rejected, access is denied but fortigate still allow connection. User is only in radius group. 

Current is:

Connection Polices: Fortigate

Client IPv4 Address Setting -> Vendor-Specyfic -> Radius Standard -> VendorCode: 12356, No, it doesn not conform (if Yes - nothing change)

Connection Polices: Use Windows authentication for all users - default

Network Polices:

For all groups is independent police. group1: Conditions: User Groups -> in group "group1", Vendor-Specyfic -> value: group1 (vendor-assigned attribute number: 1 , String, value attribute: group1)

group2: this same configuration as above but for group2.

etc.

FortiGate works is HA - two nodes in Active-active mode.

I have two radius ( for test I disabled secondary and change configuration on first but without luck)

set all-usergroup - network polices are assigned to only one group. 

type - SSL VPN. User use ssl vpn.  (IPsec is configured but only for S2S connection)

I tried:

diagnose debug application fnbamd -1 diagnose debug enable diagnose  test  authserver  radius NPS-radius mschap2 user pass but only see information from radius to fortigate, without  assigned access on the fortigate side. Logs looks good. If MFA confirm - success with group assigned in radius, if not confirmed - access rejected.    Any help will be with thanks.

[kamil]

Hi Add more comments about configuration: I configured VPN FortiGate with Radius + Azure MFA, but few groups still use LDAP configuration. Problem which appeared last time is: If user is in radius group, did not confirm or reject MFA prompt his connection is established and user is assigned to one of LDAP group in FortiGate. If confirm MFA - is assigned to correct group. In logs on NPS I see that connection is rejected, access is denied but fortigate still allow connection. User is only in radius group.  Current is: Connection Polices: Fortigate Client IPv4 Address Setting -> Vendor-Specyfic -> Radius Standard -> VendorCode: 12356, No, it doesn not conform (if Yes - nothing change)   Connection Polices: Use Windows authentication for all users - default Network Polices: For all groups is independent police. group1: Conditions: User Groups -> in group "group1", Vendor-Specyfic -> value: group1 (vendor-assigned attribute number: 1 , String, value attribute: group1) group2: this same configuration as above but for group2. etc. FortiGate works is HA - two nodes in Active-active mode. I have two radius ( for test I disabled secondary and change configuration on first but without luck)   set all-usergroup - network polices are assigned to only one group.  type - SSL VPN. User use ssl vpn.  (IPsec is configured but only for S2S connection) I tried: diagnose debug application fnbamd -1 diagnose debug enable diagnose  test  authserver  radius NPS-radius mschap2 user pass but only see information from radius to fortigate, without  assigned access on the fortigate side. Logs looks good. If MFA confirm - success with group assigned in radius, if not confirmed - access rejected.    Any help will be with thanks.

[kamil]

Logs from radius:

"Server-DC","IAS",07/21/2020,11:34:16,1,"user01@domain.com","domain\user01",,"UserExternalIPAddressInCIDFormat",,,"domain",,,0,"FortiClientExternalIPAddressInCIDFormat","FortiGateVPNClient",,,5,"vpn-ssl",,,8,"vpn_group01",0,"311 1 Internal IP Radius 07/14/2020 21:05:02 18",,,,,,,,,"11fdafec",,,,,,,,,,,,,,,,,,,,,,,,,"Fortigate VPN Connection",1,,,,

"Server-DC","IAS",07/21/2020,11:34:16,2,,"domain\user01",,,,,,,,0,"FortiClientExternalIPAddressInCIDFormat","FortiGateVPNClient",,,,,1,2,8,"vpn_group01",0,"311 1 Internal IP Radius 07/14/2020 21:05:02 18",,,,,,,,,"11fdafec",,,,,,,,,,,,,,,,,,,,,,"0xA44E4554",14,2,"Fortigate VPN Connection",1,,,,

I had to anonymize the information a bit, but I marked one information in red. Login date and another date, which probably means when the token was created? I don't know if he interprets it correctly. Is it possible to somehow clean this information so that the customer generates a new token? Is it to be done from the NPS side? Fortigate devices? On the user's side?