SSL VPN & LDAP Fails - No Matching Policy

[ericlam]

I am following this KB article: http://kb.fortinet.com/kb/microsites/microsite.do?cmd=displayKC&externalId=FD32359 trying to use LDAP to authenticate users logging into the SSL Portal based on their group membership in AD. I have two AD user groups and depending on which group the user belongs to they will get one of either two portal pages. I tested logging in as any user of either AD group but I get a permission denied error with an alert message in the event log: " SSL user failed to logged in" Reason: no_matching_policy" My Fortigate - 200B/v4MR2 Patch 7 LDAP config config user ldap edit " LDAPServer" set server " 10.50.1.2" set cnid " sAMAccountName" set dn " dc=domain,dc=local" set type regular set username " CN=LDAP Agent,OU=Agents,DC=XYZ,DC=local" set password ENC next end The two VPN Groups to authenticate config user group edit " GeneralVPN" set sslvpn-portal " Default" set member " alane" " LDAPServer" config match edit 1 set server-name " LDAPServer" set group-name " CN=GeneralVPN,OU=Vancouver,OU=Users,OU=company,DC=XYZ,DC=local" next end next edit " AccountingVPN" set sslvpn-portal " Accounting" set member " LDAPServer" config match edit 1 set server-name " LDAPServer" set group-name " CN=AccountingVPN,OU=Vancouver,OU=Users,OU=company,DC=XYZ,DC=local" next end next end Firewall policies. This is at the top of the list. config firewall policy edit 11 set srcintf " WAN1" set dstintf " switch" set srcaddr " All" set dstaddr " Vancouver" set action ssl-vpn set nat enable config identity-based-policy edit 2 set schedule " always" set logtraffic enable set groups " GeneralVPN" set service " ANY" next edit 3 set schedule " always" set groups " AccountingVPN" set service " ANY" next end next end I also have a policy from ssl.root/All -> Internal/internal range set to Accept/Any/Always as well Here' s a debug output for sslvpn PGD-FGT200B # [62:root]SSL state:before/accept initialization (74.198.150.243) [62:root]SSL state:SSLv2/v3 read client hello A:system lib(74.198.150.243) [62:root]SSL state:SSLv3 read client hello A (74.198.150.243) [62:root]SSL state:SSLv3 write server hello A (74.198.150.243) [62:root]SSL state:SSLv3 write change cipher spec A (74.198.150.243) [62:root]SSL state:SSLv3 write finished B (74.198.150.243) [62:root]SSL state:SSLv3 flush data (74.198.150.243) [62:root]SSL state:SSLv3 read finished A:system lib(74.198.150.243) [62:root]SSL state:SSLv3 read finished A:system lib(74.198.150.243) [62:root]SSL state:SSLv3 read finished A (74.198.150.243) [62:root]SSL state:SSL negotiation finished successfully (74.198.150.243) [62:root]two factor check for test: off [62:root]Auth failed due to group restrictions [62:root]rmt_logincheck.c:207 user[test],auth_type=32768 failed [no_matching_policy] [62:root]rmt_websession.c:47 status=1;host=74.198.150.243;fails=1;logintime=1308336797 [62:root]SSL state:warning close notify (74.198.150.243) [62:root]SSL state:warning close notify (74.198.150.243) [62:root]Destroy sconn 0x99c8988, connSize=0. [62:root]SSL state:before/accept initialization (74.198.150.243) [62:root]SSL state:SSLv2/v3 read client hello A:system lib(74.198.150.243) [62:root]SSL state:SSLv3 read client hello A (74.198.150.243) [62:root]SSL state:SSLv3 write server hello A (74.198.150.243) [62:root]SSL state:SSLv3 write certificate A (74.198.150.243) [62:root]SSL state:SSLv3 write server done A (74.198.150.243) [62:root]SSL state:SSLv3 flush data (74.198.150.243) [62:root]SSL state:SSLv3 read client certificate A:system lib(74.198.150.243) [62:root]SSL state:SSLv3 read client certificate A:system lib(74.198.150.243) [62:root]SSL state:SSLv3 read client key exchange A (74.198.150.243) [62:root]SSL state:SSLv3 read certificate verify A:system lib(74.198.150.243) [62:root]SSL state:SSLv3 read certificate verify A:system lib(74.198.150.243) [62:root]SSL state:SSLv3 read finished A (74.198.150.243) [62:root]SSL state:SSLv3 write change cipher spec A (74.198.150.243) [62:root]SSL state:SSLv3 write finished B (74.198.150.243) [62:root]SSL state:SSLv3 flush data (74.198.150.243) [62:root]SSL state:SSL negotiation finished successfully (74.198.150.243) [62:root]SSL state:warning close notify (74.198.150.243) [62:root]SSL state:warning close notify (74.198.150.243) [62:root]Destroy sconn 0x99c8988, connSize=0. Any help would be greatly appreciated while I await TAC to respond. Regards, Eric

[ViktorsCS]

Same issue for me, and same solution to specify source-ip in ldap config

[teamnoc]

I had a similar problem, the connection won't be made if the user is in the group "protected users" in the LDAP.