RSSO with NPS and 802.1x

CourtKPrin · ‎02-13-2023

I want to create Fortigate policies that apply different web filtering to members of AD security groups, based on student grade levels. I have followed the Technical Tip: Configuring Radius Single Sign-On using NPS 2019. The students are able to connect to the wireless network, authenticate using 802.x, and placed in a specific VLAN. I'm struggling with passing the Network Policy's Class value (TestRSSO) from the NPS to the Fortigate. Where would this information show up when it's working, because I don't think it is.

Would FSSO be a better option for this?

Markus_M · ‎02-13-2023

Hi CourtKPrin,

RSSO is perfectly fine. It supports logon, ip change and logoff.

Just needs to be set properly:

https://docs.fortinet.com/document/fortigate/6.2.12/cookbook/85730/radius-single-sign-on-rsso-agent

https://community.fortinet.com/t5/FortiAP/Technical-Tip-Radius-Single-Sign-On-RSSO/ta-p/191223

What is not often understood is that these parts:

        set rsso-endpoint-attribute <attribute>
        set sso-attribute <attribute>

are a mapping instruction on FortiGate. In words:

FortiGate, you take the information of what user name this is (value) from this attribute (name).

FortiGate, you take the information of what group name this is (value) from this attribute (name).

You can freely specify what the user identifying attribute name should be and what the grouping attribute should be.

If unsure, create a packet capture on the FortiGate for port 1813 and see the accounting type start packets for the respective attribute names, that contain the username.

Best regards,

Markus

View solution in original post

CourtKPrin · ‎02-16-2023

My co-workers started a ticket with Fortinet. Support is saying the two classes are concatenated. I'll ask them to verify that the Fortigate can handle the two class attributes and match against one of them.

Debbie_FTNT · ‎02-20-2023

Hey CourtKPrin,

in my previous update I mentioned FortiGate should be able to handle two instances of the Class attribute.

To elaborate on that - if the Class attribute appears twice with separate values, then the FortiGate can parse that and treat each separate value as one group name. In your case, with the group name and other information in the same Class attribute, I don't think that will quite work, Fortigate doesn't do a substring match (it's not just looking for the defined group name in the Class attribute, and ignores all other data in the same attribute, it's looking for an exact match).

+++ Divide by Cucumber Error. Please Reinstall Universe and Reboot +++

CourtKPrin · ‎02-20-2023

Hi,

It is working now and the Fortigate parses multiple class attributes and matches the one I need. The settings on the Fortigate were correct all along. However, the Fortigate wasn't getting the Framed-IP-Address attribute from the accounting start messages and an IP is required by the Fortigate for RSSO to work. I now understand this is by design because the IP provided by DHCP isn't given until after authentication. The accounting interim-update messages provide the Framed-IP-Address attribute and IP value. For those using Mist, enable the "interim accounting" setting to send the appropriate accounting messages with the Framed-IP-Address.

I want to clarify that our third-party wifi is configured with the NPS's IP address for the radius and accounting servers. The NPS is then configured to forward accounting messages to the Fortigate.

I also want to clarify for those that come across this thread that the article linked to by Markus_M is a good one to follow. If you find other Fortigate articles that discuss adding a Radius Server and NPS client, it can be ignored if the clients are not authenticating through the Fortigate.

Debbie_FTNT · ‎02-21-2023

Thank you for sharing the details CourtKPrin :)

+++ Divide by Cucumber Error. Please Reinstall Universe and Reboot +++