RSSO with NPS and 802.1x

[CourtKPrin]

I want to create Fortigate policies that apply different web filtering to members of AD security groups, based on student grade levels. I have followed the Technical Tip: Configuring Radius Single Sign-On using NPS 2019. The students are able to connect to the wireless network, authenticate using 802.x, and placed in a specific VLAN. I'm struggling with passing the Network Policy's Class value (TestRSSO) from the NPS to the Fortigate. Where would this information show up when it's working, because I don't think it is.

Would FSSO be a better option for this?

[CourtKPrin]

My co-workers started a ticket with Fortinet. Support is saying the two classes are concatenated. I'll ask them to verify that the Fortigate can handle the two class attributes and match against one of them.

[Debbie_FTNT]

Hey CourtKPrin,

in my previous update I mentioned FortiGate should be able to handle two instances of the Class attribute.

To elaborate on that - if the Class attribute appears twice with separate values, then the FortiGate can parse that and treat each separate value as one group name. In your case, with the group name and other information in the same Class attribute, I don't think that will quite work, Fortigate doesn't do a substring match (it's not just looking for the defined group name in the Class attribute, and ignores all other data in the same attribute, it's looking for an exact match).

[CourtKPrin]

Hi,

It is working now and the Fortigate parses multiple class attributes and matches the one I need. The settings on the Fortigate were correct all along. However, the Fortigate wasn't getting the Framed-IP-Address attribute from the accounting start messages and an IP is required by the Fortigate for RSSO to work. I now understand this is by design because the IP provided by DHCP isn't given until after authentication. The accounting interim-update messages provide the Framed-IP-Address attribute and IP value. For those using Mist, enable the "interim accounting" setting to send the appropriate accounting messages with the Framed-IP-Address.

I want to clarify that our third-party wifi is configured with the NPS's IP address for the radius and accounting servers. The NPS is then configured to forward accounting messages to the Fortigate.

I also want to clarify for those that come across this thread that the article linked to by Markus_M is a good one to follow. If you find other Fortigate articles that discuss adding a Radius Server and NPS client, it can be ignored if the clients are not authenticating through the Fortigate.

[Debbie_FTNT]

Thank you for sharing the details CourtKPrin :)