Logging out???

[#1]

Dear Friends, I' m using FortiGate 100A and I have conifigured the access by authentication page (by the vay of external radius). All works fine but, whena client want to logout, what is the page to go for logging out? In other words how a client can logout from the connection? Best regards Renzo Rucco

[jmac]

FSAE is only used for authentication, not for logoffs. Windows domain controllers do not receive logout information either, so it cannot be passed along via FSAE. FSAE deauthenticates connections based on a combination of a timeout setting in the FSAE config and polling the Windows workstations to determine if the authenticated user is still logged on. If the polling process (workstation verify interval) can no longer verify if the user is logged in, they will be deauthenticated when the " dead entry timeout interval" expires.

[ede_pfau]

They do it for SSL VPN and for admin access so why not for end users.

Because in the case of SSL VPN or admin access the ' stateful' device is the FG itself. It has full control over the session it has allowed. So when you click the ' logout' button it kills the corresponding session. For IBPs, the first problem is how to authenticate: it takes an interactive process to enter credentials. So you can use HTTP, HTTPS, ftp or telnet. How would a user notify the FG that he/she wants to log out? After all, traffic from the user is authenticated and the firewall is no longer watching it. I am still trying to think of a decent way how to handle a logout request interactively if all the FG sees is a data stream. And when the user logs out and somehow notifies the FG of this fact, should all of his sessions be killed? Or certain protocols only, or sessions from a certain host only? Ain' t that easy.

[#4]

The authentication process is successful through a web page. All you need is a direct address url, for example http://192.168.1.1/logout (as many other manufacturers do it: for example D-link DFL210), which is communicated to client through which make a logout. Best regards. Renzo Rucco