Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor


Hello Guys,


I am a bit stuck on something I want to achieve, but not sure how to complete the required.

Please see the below low down:-

Successfully create a RADIUS and LDAP Server, with a successful query.

I have created two SSL VPN Portals

  • Split Tunnel
  • Full Tunnel[/ul]

    From each of the portals I want the following to happen:-

  • Both Portals will use RADIUS Auth (this is key)
  • Split Tunnel Portal would use RADIUS AUTH[ul]
  • LDAP QUERY would look into AD and a users group Split_Tunnel would infact get Split Tunnel[/ul]
  • Full Tunnel Portal would use RADIUS AUTH[ul]
  • LDAP Query would look into AD and a user group Full_tunnel would route all traffic down the tunnel[/ul][/ul]

    Is it possible, for a RADIUS Auth user, to get the relevant SSL VPN Portal config, based on their LDAP query?


    I have achieved the above previously with Juniper/Pulse, but this is my first time trying with the Fortigate. Running latest version 7.0.1 (as 7.0 broken LDAP queries from the GUI and I was getting ldap-3) :) 


    Any help much appreciated!

  • 2 REPLIES 2
    New Contributor II



    You radius server check LDAP for authentication and return relevant group information. 




    Hey Steve,
    FortiGate would NOT perform an LDAP query after RADIUS auth.
    It would allow getting group information from the RADIUS reply itself and matching local user groups on FortiGate based on the RADIUS attributes. The SSLVPN portal (and split-tunneling) would be selected based on group information in the RADIUS reply.
    You might want to check this:
    - ensure your RADIUS server response includes the Fortinet-Group-Name attribute
    -> depending on the RADIUS server, you can ensure that it includes the Fortinet-Group-Name based on LDAP group lookup (something roughly like this can be done on FortiAuthenticator, for example)
    - match into groups on FortiGate based on this attribute
    - match SSLVPN portal based on the group
    Fortinet RADIUS dictionary:
    I hope that helps :)

    +++ Divide by Cucumber Error. Please Reinstall Universe and Reboot +++

    Select Forum Responses to become Knowledge Articles!

    Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

    Top Kudoed Authors