Hello everybody, I have a Fortinet VM-64 (version v5.4.7,build6446 ) to provide SSLVPN service. My customer provides a radius server for SSLVPN authentication. But their radius server can't response group information when doing authentication. So I create many account with radius on the VM-64, and mapping them with different group. But there is a problem with group mapping. When client use a account which exist in the radius server but doesn't exist in the VM-64 to login SSLVPN, it will login success and mapping to group for the first account in the account list. For example: ----------------- I have two account in the VM-64. AAA in radius is group-X (It's the first account in the list) BBB in radius is group-Y There are three account in the radius server.(Because the radius server is not only for SSLVPN) AAA BBB CCC When client use CCC to login SSLVPN, he will login success and mapping to group-X. ------------------- Because different group have different access control list, so it will be a issue in security. And it's strange to mapping a account which doesn't exist to a exist group. It look like a vulnerability or program logic error in the authentication? Could you kindly give me some suggestion to resolve it? Thanks a lot : )
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Yes , I have to agree with the last pose VSA is what you want and if you have a RADIUS server that does not recognize VSA than abandon it
FWIW here the fortinet VSA
http://kb.fortinet.com/kb/viewContent.do?externalId=FD36919&sliceId=1
PCNSE
NSE
StrongSwan
Thanks for reply: )
I agree with the solution which if radius can reply group attribute.
But the guys manage the radius is a senior engineer who don't like to change things.
It's diffcult to ask him to editing about 200 account for me....Orz
Changing the user or use a Radius-aaS like jumpcloud
Ken
PCNSE
NSE
StrongSwan
Thank you for reply: )
I can't agree you anymore.
But the user is our customer.
So that I think the user is more important than me. hahahahah
Hello
what (include in every user group) is about from practical perspective
lets suppose that I have a local group in fortigate named GuestUsers which includes the local users :ahmad,david and
sami. what this option will add to this group ?
thank you for your reply.
Hello everybody, i have few user group in the radius server (windows server base) and would like to assign different access permission for those group. When i configure user group with radius and the group configure "specify", the authentication is not working. If i put any in the group option that is working fine but that is not fulfil the design (assign different user group with different access permission) May i know is there pre-requisite requirement to configure "specify group? I did some research that said use "AVP" to mapping radius user group. May i know is that compulsory use "AVP or other way can map the radius user group? Thanks.
as I said in second update in this thread .. reading comments DOES help, really.
And as I replied directly to your same question .. https://forum.fortinet.com/tm.aspx?tree=true&m=199827
That feature is usually referenced as "RADIUS group match". And I hope that this KB will clarify all that: https://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD36464
More precisely, AVP you are looking for is in the middle of the doc in FreeRADIUS config example, and in packet capture below, and it is "Fortinet-Group-Name". FGT does full and clear string match of received Fortinet-Group-Name against what's in "set group-name" in config match in user group (on FGT).
Tomas Stribrny - NASDAQ:FTNT - Fortinet Inc. - TAC Staff Engineer
AAA, MFA, VoIP and other Fortinet stuff
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1692 | |
1087 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.