RSSO in 6.2.3 doesn't define "user group" in policy

[Art]

Hello everyone,

We have FG300 with FortiOS 6.2.3 and Freeradius. Use RSSO to authorize WIFI users. The user falls into the group on FG, but it is not defined in the policy and, accordingly, the policy does not work. We need help, which may be the reason.

FortiGate # dia test app radiusd 3 RADIUS server database [vd root]: "index","time left","ip","endpoint","block status","log status","profile group","ref count","use default profile" 1,07:58:42,"192.168.51.10""host/ARM0796.lokb.spb.ru","allow","no log","<default profile>",1,Yes 2,07:59:57,"192.168.57.4""ushakov","allow","no log","usersLOKB",1,No

FortiGate # sh user radius RSSO\ Agent config user radius edit "RSSO Agent" set rsso enable set rsso-radius-response enable set rsso-validate-request-secret enable set rsso-secret "secret" set rsso-endpoint-attribute User-Name set rsso-flush-ip-session enable set rsso-ep-one-ip-only enable next end

FortiGate # sh user group RADIUS\ users config user group edit "RADIUS users" set group-type rsso set sso-attribute-value "usersLOKB" next end

Received radius accounting eventvd 0:root Add/Update auth logon for IP 192.168.57.4 for user ushakov DB 0 insert [ep='ushakov' pg='usersLOKB' ip='192.168.57.4/32'] success

User is visible in Monitor > Firewall User Monitor as the rsso user, but policy doesn't work

[mschoenberger]

I am having the same issue. Users get assigned to the appropriate groups, but when I add the RSSO Group to a policy, it does not work.

[mschoenberger]

WE are going to upgrade the software to 6.2.4 tonight to see if this solves our issue.

[Art]

We are not yet able to update the version OS, please report the result....)

[mschoenberger · Accepted solution]

I have figured it out.

You have to set rsso enable in the CLI for the policy before it would work as follows:

CaveCreekUnified-SNA~T01 $ config firewall policy CaveCreekUnified-SNA~T01 (policy) $ edit <policyID> CaveCreekUnified-SNA~T01 (52) $ set rsso enable CaveCreekUnified-SNA~T01 (52) $ end

[Art]

It really solved the problem! Thank you very much, you are cool!))))

[mschoenberger]

Glad to be of help. I am new to this Firewall, coming from a Cisco ASA and a Netspective Webfilter. I love the full integration and flexibility of the product. I do hope the configuration interfaces mature a bit more so CLI changes are not necessary.

[reto_gobat]

Thanks a lot! This worked.

Does anybody know if this is intended or a bug? I think the same counts for FSSO.

[mschoenberger]

reto.gobat wrote:

Thanks a lot! This worked.

Does anybody know if this is intended or a bug? I think the same counts for FSSO.

Does not appear to be a bug, but to operate as intended. It is just that Fortinet has not fully implemented some settings into the GUI of the product. Given time, I am sure a lot of these CLI settings will slowly be available in the GUI.

[rijocumo]

mschoenberger wrote:

I have figured it out.

You have to set rsso enable in the CLI for the policy before it would work as follows:

CaveCreekUnified-SNA~T01 $ config firewall policy CaveCreekUnified-SNA~T01 (policy) $ edit <policyID> CaveCreekUnified-SNA~T01 (52) $ set rsso enable CaveCreekUnified-SNA~T01 (52) $ end

Hello.

In version 6.4.4 this command is not available to apply in the policy. Without this command I assume that no request arrives at RADIUS. Any suggestion?

Thanks.