Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
yugiohx
New Contributor

Radius user group mapping problem

Hello everybody, I have a Fortinet VM-64 (version v5.4.7,build6446 ) to provide SSLVPN service. My customer provides a radius server for SSLVPN authentication. But their radius server can't response group information when doing authentication. So I create many account with radius on the VM-64, and mapping them with different group. But there is a problem with group mapping. When client use a account which exist in the radius server but doesn't exist in the VM-64 to login SSLVPN, it will login success and mapping to group for the first account in the account list. For example: ----------------- I have two account in the VM-64. AAA in radius is group-X  (It's the first account in the list) BBB in radius is group-Y There are three account in the radius server.(Because the radius server is not only for SSLVPN) AAA BBB CCC When client use CCC to login SSLVPN, he will login success and mapping to group-X. ------------------- Because different group have different access control list, so it will be a issue in security. And it's strange to mapping a account which doesn't exist to a exist group. It look like a vulnerability or program logic error in the authentication? Could you kindly give me some suggestion to resolve it? Thanks a lot : )

19 REPLIES 19
emnoc
Esteemed Contributor III

Yes , I have to agree with the last pose VSA is what you want and if you have a RADIUS server that does not  recognize VSA than abandon it 

 

FWIW here the  fortinet VSA

 

http://kb.fortinet.com/kb/viewContent.do?externalId=FD36919&sliceId=1

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
yugiohx
New Contributor

Thanks for reply: )

I agree with the solution which if radius can reply group attribute.

But the guys manage the radius is a senior engineer who don't like to change things.

It's diffcult to ask him to editing about 200 account for me....Orz

emnoc
Esteemed Contributor III

Changing the  user or use a Radius-aaS  like jumpcloud 

 

Ken 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
yugiohx
New Contributor

Thank you for reply: )

I can't agree you anymore.

But the user is our customer.

So that I think the user is more important than me. hahahahah

marco_digirolamo

Be sure you don't flag this option when you configure Radius server, or any user could be able to authenticate against it also if not mapped anywhere (see image attached).

 

Hashim_Nangarhari

Hello 

what (include in every user group) is about from practical perspective 

lets suppose that I have a local group in fortigate named GuestUsers which includes the local users :ahmad,david and

sami. what this option will add to this group ?

marco_digirolamo

If you flag that option you permit every user group in your fortigate to check credentials on radius server unless specifications, so if you have a radius policy on your radius server that matches unconditionally, a user could successfully login against this method also if not mapped anywhere.
Hashim_Nangarhari

thank you for your reply.

 

ck888

Hello everybody,   i have few user group in the radius server (windows server base) and would like to assign different access permission for those group.   When i configure user group with radius and the group configure "specify", the authentication is not working. If i put any in the group option that is working fine but that is not fulfil the design (assign  different user group with different access permission) May i know is there pre-requisite requirement to configure "specify group?   I did some research that said use "AVP" to mapping radius user group. May i know is that compulsory use "AVP or other way can map the radius user group?   Thanks.

xsilver_FTNT

as I said in second update in this thread .. reading comments DOES help, really.

And as I replied directly to your same question .. https://forum.fortinet.com/tm.aspx?tree=true&m=199827

 

That feature is usually referenced as "RADIUS group match". And I hope that this KB will clarify all that: https://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD36464

 

More precisely, AVP you are looking for is in the middle of the doc in FreeRADIUS config example, and in packet capture below, and it is "Fortinet-Group-Name". FGT does full and clear string match of received Fortinet-Group-Name against what's in "set group-name" in config match in user group (on FGT).

Tomas Stribrny - NASDAQ:FTNT - Fortinet Inc. - TAC Staff Engineer
AAA, MFA, VoIP and other Fortinet stuff

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors