Policies using LDAP groups

[sramos]

I am implementing a firewall between users and servers.  The policies are currently based on destination IP and port.  I would like to add more granularity based on who the user is.  Is there a way to create a policy that will allow only if the traffic is sourced from a user who is a member of a specific group?

[sw2090]

hm I never directly used LDAP here but I use Active Directory (which basically uses LDAP as backend). As it is possible to use AD Users/Groups on a FGT I think this will work with LDAP too.

You could then create a Policy that uses the LDAP Usergroup as Source.

UP to now I never used it in Policies up to now but I do use it for Login Auth on my FGTs.

[julienlux]

You can also use the FSSO Agent install on your DC. Configure the firewall to connect to that agent and doing some mapping to have user group on the firewall.

I've already use either LDAP and FSSO and i've has some issue with LDAP which was not the case yith FSSO agent. That's why i would recomment you to use FSSO agent.