Hello everyone. Today in my company we have 4 fortigates and we all use local user. We’re looking to switch to AD authentication, but I need to restrict the Ips that can be accessed using users. Today as we use local user I did the restriction using Trusted hosts. How could I do the same, but for AD users?
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi,
1. you can still have locally defined users but 'remote' type pointing to LDAP. One by one used in User Group which can be used somewhere in Firewall policies .. that's closest to complete local password based users.
HINT: Keep in mind that FortiOS is Unix-based system and so usernames ARE case sensitive in this case!
Example:
edit "Alice" set type ldap set ldap-server "LDAP-SRV" next
2. you can have a group pointing directly to LDAP, so no local users and anyone matching the group filter will be considered member. In this case user authentication is handled towards external server without username match on FortiGate and so if LDAP server is case insensitive on usernames, like MSFT AD is, then mixed character cases in username will work.
Example:
edit "Group_LDAP" set member "LDAP-SRV" config match edit 1 set server-name "LDAP-SRV" set group-name "CN=Domain Users,CN=Users,DC=example,DC=org" next end next
Those will work mainly as your previous users.
I'm not sure if I do understand to restrict IP requirement as that is usually applied to Administrators logins, not to users.
More might be seen here: https://docs.fortinet.com/document/fortigate/6.4.7/administration-guide/954635/getting-started
And if you were speaking about admins, then here:
Tomas Stribrny - NASDAQ:FTNT - Fortinet Inc. - TAC Staff Engineer
AAA, MFA, VoIP and other Fortinet stuff
Hi,
1. you can still have locally defined users but 'remote' type pointing to LDAP. One by one used in User Group which can be used somewhere in Firewall policies .. that's closest to complete local password based users.
HINT: Keep in mind that FortiOS is Unix-based system and so usernames ARE case sensitive in this case!
Example:
edit "Alice" set type ldap set ldap-server "LDAP-SRV" next
2. you can have a group pointing directly to LDAP, so no local users and anyone matching the group filter will be considered member. In this case user authentication is handled towards external server without username match on FortiGate and so if LDAP server is case insensitive on usernames, like MSFT AD is, then mixed character cases in username will work.
Example:
edit "Group_LDAP" set member "LDAP-SRV" config match edit 1 set server-name "LDAP-SRV" set group-name "CN=Domain Users,CN=Users,DC=example,DC=org" next end next
Those will work mainly as your previous users.
I'm not sure if I do understand to restrict IP requirement as that is usually applied to Administrators logins, not to users.
More might be seen here: https://docs.fortinet.com/document/fortigate/6.4.7/administration-guide/954635/getting-started
And if you were speaking about admins, then here:
Tomas Stribrny - NASDAQ:FTNT - Fortinet Inc. - TAC Staff Engineer
AAA, MFA, VoIP and other Fortinet stuff
Thank you for your reply. Today we use local administrators and do IP restrictions that can log in with these users. I would like to do the same, but using authenticated users via AD. Can’t do that? If I create as per the documentation below, putting users in the policy, does it work? https://kb.fortinet.com/k....do?externalID=FD46240
Users, user groups and especially firewall policies are applied to pass-through traffic.
Access to the unit itself. Admin access. Is driven by access profiles, allowaccess on interfaces (and possibly by local-in-policies but that's advanced tech).
Easiest way is to follow my second link from previous post, about wildcard LDAP admin. And make one. It's a wildcard / placeholder, for any possible AD user who belongs to set group match. In example for 'edit "ldap_grp"' those possible admins have to be members of AD group "CN=GRP,OU=training,DC=example,DC=COM".
Pay attention to that group match, and I would also highly recommend to use this specific group, in example "ldap_grp", for admin access only! Not anywhere else.
Another approach would be to make single local admins, see "Alice" below. Pointed to LDAP, and so their credentials will be verified not locally, but against designated LDAP server defined as remote group, so group match is again possible.
And such local admin accounts can also have backup password usable in case LDAP is unreachable.
config system admin
edit "Alice" set remote-auth enable set accprofile "super_admin" set vdom "root" set remote-group "remote-admins-ldap" set password ENC SH2cGT11lw47mF6ZNxsMz4IfS0eWn9s3yYybd9Wd20vYoyTMSfIoxpiZikDO2E= next
end
Above example is similar to this KB, but swap anything RADIUS (like config user radius for config user ldap etc.) for LDAP and it will work.
https://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD32808
As those will be solo admins on FGT then same rule and trusted hosts does apply on those as if those would be completely local admins.
Have a look to documentation and/or Knowledge Base but focus on admin access to FortiGate itself.
Tomas Stribrny - NASDAQ:FTNT - Fortinet Inc. - TAC Staff Engineer
AAA, MFA, VoIP and other Fortinet stuff
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1641 | |
1069 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.