Securing GUI login for the ADMIN user on FortiGate VM in AWS.

[systemgeek]

I am trying to configure trusthost for the user ADMIN on my fortigate with the following:

config system admin

edit admin

set trustedhost1 172.25.176.23 255.255.255.255

set trustedhost2 172.25.177.0 255.255.255.0

end

My other users use ADFS SSO login with 2FA so I am ok with them accessing the FortiGate from the internet.  I just want to block the default admin account (and any other non 2FA backed account) from logging in via the internet.  I do want to allow the admin user to be able to login from our internal AD domain servers.

When I set this up though I found that ALL users were blocked from accessing the FortiGate unless they came from our AD servers.  Support is trying to tell me that setting up the trusthost effects ALL users and not individual users.  I find this very hard to believe that Fortinet would prevent people from controlling where a user logs in from on an account by account basis.  Linux has been doing this for MANY MANY years.  And FortiOS is based on Linux.

Can someone please tell me how I set this up.   I am running FortiGate VM AWS vers 7.4.3.

[jiahoong112]

From my understanding, you do not want users from the Internet to log into your Fortigate with 'admin' (this is the default builtin superadmin) account. The only way you can achieve this is by using Trusted Host. 

For your adfs users to log in ensure a similar configuration is followed: https://community.fortinet.com/t5/FortiGate/Technical-Tip-SAML-SSO-login-for-FortiGate-administrator... 
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-SAML-SSO-login-for-FortiGate/t... 

[hbac]

Hi @systemgeek,

Trusted host is only available to configure for LOCAL, TACACS+, PKI and LOCAL admin-type but not for SSO admin. If all other admins have a trusted host set, the SSO-Admin will not be able to login if not coming from one of the trusted host IP addresses because the login page will not come up. 

Regards, 

[systemgeek · Accepted solution]

I found that I needed to create a new "admin" with a profile of no rights.  Once I did this I could modify the Admin user to use trustedhost and it did not effect the saml sso admin users.