I am trying to configure trusthost for the user ADMIN on my fortigate with the following:
config system admin
edit admin
set trustedhost1 172.25.176.23 255.255.255.255
set trustedhost2 172.25.177.0 255.255.255.0
end
My other users use ADFS SSO login with 2FA so I am ok with them accessing the FortiGate from the internet. I just want to block the default admin account (and any other non 2FA backed account) from logging in via the internet. I do want to allow the admin user to be able to login from our internal AD domain servers.
When I set this up though I found that ALL users were blocked from accessing the FortiGate unless they came from our AD servers. Support is trying to tell me that setting up the trusthost effects ALL users and not individual users. I find this very hard to believe that Fortinet would prevent people from controlling where a user logs in from on an account by account basis. Linux has been doing this for MANY MANY years. And FortiOS is based on Linux.
Can someone please tell me how I set this up. I am running FortiGate VM AWS vers 7.4.3.
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
I found that I needed to create a new "admin" with a profile of no rights. Once I did this I could modify the Admin user to use trustedhost and it did not effect the saml sso admin users.
From my understanding, you do not want users from the Internet to log into your Fortigate with 'admin' (this is the default builtin superadmin) account. The only way you can achieve this is by using Trusted Host.
For your adfs users to log in ensure a similar configuration is followed: https://community.fortinet.com/t5/FortiGate/Technical-Tip-SAML-SSO-login-for-FortiGate-administrator...
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-SAML-SSO-login-for-FortiGate/t...
Hi @systemgeek,
Trusted host is only available to configure for LOCAL, TACACS+, PKI and LOCAL admin-type but not for SSO admin. If all other admins have a trusted host set, the SSO-Admin will not be able to login if not coming from one of the trusted host IP addresses because the login page will not come up.
Regards,
I found that I needed to create a new "admin" with a profile of no rights. Once I did this I could modify the Admin user to use trustedhost and it did not effect the saml sso admin users.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1517 | |
1013 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.