Security Policy Authentication for HTTP (not port 80)

[Eric_Lackey]

We are trying to set up a security policy that requires the user to authenticate to the firewall when accessing a particular internal web page. It works fine if the destination site is on port 80, but not when the site is hosted on a different port (port 3000 in this case). I think it's related to the Authentication > Settings where you select the Protocol Support. It allows you to select HTTP and HTTPS, but not a specific port. 

[techevo]

Eric Lackey wrote:

We are trying to set up a security policy that requires the user to authenticate to the firewall when accessing a particular internal web page. It works fine if the destination site is on port 80, but not when the site is hosted on a different port (port 3000 in this case). I think it's related to the Authentication > Settings where you select the Protocol Support. It allows you to select HTTP and HTTPS, but not a specific port. 

Did you try changing your http port or adding a new port under :  Policy & objects - Policy - Proxy Option ?

Maybe adding port 3000 to the HTTP protocol would help.

Create a test profile and make sure you apply this profile to the appropriate policy under proxy options.

Let us know.

Thanks,

[Eric_Lackey]

Thanks for your response. That was my initial thought too. After I read your post, I went back and looked and realized I had not configured it correctly. I believe I have everything set right now and it's still not working. The proxy settings appear to only work with the Web Filtering and not the authentication. Below is what the debug looks like. My mobile device is 10.2.8.238 and I'm trying to connect to a server with IP address 10.1.3.136 on port 3000. I have a security policy (155) that allows port 3000 from the 10.2.8 network to the 10.1.3 network. I have selected the default web filter and then chosen a proxy that has HTTP set to port 3000. 

id=20085 trace_id=6744 func=print_pkt_detail line=4368 msg="vd-fpp received a packet(proto=6, 10.2.8.238:49255->10.1.3.136:3000) from vlan.lamposwn. flag , seq 617823222, ack 0, win 65535"id=20085 trace_id=6744 func=init_ip_session_common line=4517 msg="allocate a new session-99c3d81e"id=20085 trace_id=6744 func=vf_ip4_route_input line=1596 msg="find a route: flags=00000000 gw-10.2.1.11 via vlan.internal"id=20085 trace_id=6744 func=fw_forward_handler line=554 msg="Denied by forward policy check (policy 155)"

[Bromont_FTNT]

recheck that firewall policy 155

[Eric_Lackey · Accepted solution]

Fortinet got back to me with the solution on this. I would have never found it. I already tried it and it works great. Hope it's helpful for someone else. 

Hello,  Thank you for contacting Fortinet TAC. My name is Phil and I will be assisting you with this ticket.  To have the FortiGate present a login page on alternate ports, it can be added from the CLI:  # config user setting  # config auth-ports  # edit <auth-table-entry-id>  Use 0 for a new entry  # set port <port_int>  # set type {ftp | http | https | telnet}  Choose HTTP or HTTPS for webpages  # end  # end