Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Art
New Contributor

RSSO in 6.2.3 doesn't define "user group" in policy

Hello everyone,

We have FG300 with FortiOS 6.2.3 and Freeradius. Use RSSO to authorize WIFI users. The user falls into the group on FG, but it is not defined in the policy and, accordingly, the policy does not work. We need help, which may be the reason.

 

FortiGate # dia test app radiusd 3 RADIUS server database [vd root]: "index","time left","ip","endpoint","block status","log status","profile group","ref count","use default profile" 1,07:58:42,"192.168.51.10""host/ARM0796.lokb.spb.ru","allow","no log","<default profile>",1,Yes 2,07:59:57,"192.168.57.4""ushakov","allow","no log","usersLOKB",1,No

 

FortiGate # sh user radius RSSO\ Agent config user radius edit "RSSO Agent" set rsso enable set rsso-radius-response enable set rsso-validate-request-secret enable set rsso-secret "secret" set rsso-endpoint-attribute User-Name set rsso-flush-ip-session enable set rsso-ep-one-ip-only enable next end

 

FortiGate # sh user group RADIUS\ users config user group edit "RADIUS users" set group-type rsso set sso-attribute-value "usersLOKB" next end

 

 

Received radius accounting eventvd 0:root Add/Update auth logon for IP 192.168.57.4 for user ushakov DB 0 insert [ep='ushakov' pg='usersLOKB' ip='192.168.57.4/32'] success

 

User is visible in Monitor > Firewall User Monitor as the rsso user, but policy doesn't work

 

 

 

1 Solution
mschoenberger
New Contributor II

I have figured it out.

 

You have to set rsso enable in the CLI for the policy before it would work as follows:

CaveCreekUnified-SNA~T01 $ config firewall policy CaveCreekUnified-SNA~T01 (policy) $ edit <policyID> CaveCreekUnified-SNA~T01 (52) $ set rsso enable CaveCreekUnified-SNA~T01 (52) $ end

 

 

View solution in original post

9 REPLIES 9
mschoenberger
New Contributor II

I am having the same issue. Users get assigned to the appropriate groups, but when I add the RSSO Group to a policy, it does not work.

 

mschoenberger

WE are going to upgrade the software to 6.2.4 tonight to see if this solves our issue.

Art

We are not yet able to update the version OS, please report the result....)

mschoenberger
New Contributor II

I have figured it out.

 

You have to set rsso enable in the CLI for the policy before it would work as follows:

CaveCreekUnified-SNA~T01 $ config firewall policy CaveCreekUnified-SNA~T01 (policy) $ edit <policyID> CaveCreekUnified-SNA~T01 (52) $ set rsso enable CaveCreekUnified-SNA~T01 (52) $ end

 

 

Art

It really solved the problem! Thank you very much, you are cool!))))

mschoenberger
New Contributor II

Glad to be of help. I am new to this Firewall, coming from a Cisco ASA and a Netspective Webfilter. I love the full integration and flexibility of the product. I do hope the configuration interfaces mature a bit more so CLI changes are not necessary.

 

reto_gobat

Thanks a lot! This worked.

Does anybody know if this is intended or a bug? I think the same counts for FSSO.

mschoenberger

reto.gobat wrote:

Thanks a lot! This worked.

Does anybody know if this is intended or a bug? I think the same counts for FSSO.

Does not appear to be a bug, but to operate as intended. It is just that Fortinet has not fully implemented some settings into the GUI of the product. Given time, I am sure a lot of these CLI settings will slowly be available in the GUI.

 

rijocumo

mschoenberger wrote:

I have figured it out.

 

You have to set rsso enable in the CLI for the policy before it would work as follows:

CaveCreekUnified-SNA~T01 $ config firewall policy CaveCreekUnified-SNA~T01 (policy) $ edit <policyID> CaveCreekUnified-SNA~T01 (52) $ set rsso enable CaveCreekUnified-SNA~T01 (52) $ end

 

 

Hello.

In version 6.4.4 this command is not available to apply in the policy. Without this command I assume that no request arrives at RADIUS. Any suggestion?

Thanks.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors