We are trying to set up a security policy that requires the user to authenticate to the firewall when accessing a particular internal web page. It works fine if the destination site is on port 80, but not when the site is hosted on a different port (port 3000 in this case). I think it's related to the Authentication > Settings where you select the Protocol Support. It allows you to select HTTP and HTTPS, but not a specific port.
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Fortinet got back to me with the solution on this. I would have never found it. I already tried it and it works great. Hope it's helpful for someone else.
Hello, Thank you for contacting Fortinet TAC. My name is Phil and I will be assisting you with this ticket. To have the FortiGate present a login page on alternate ports, it can be added from the CLI: # config user setting # config auth-ports # edit <auth-table-entry-id> Use 0 for a new entry # set port <port_int> # set type {ftp | http | https | telnet} Choose HTTP or HTTPS for webpages # end # end
Eric Lackey wrote:We are trying to set up a security policy that requires the user to authenticate to the firewall when accessing a particular internal web page. It works fine if the destination site is on port 80, but not when the site is hosted on a different port (port 3000 in this case). I think it's related to the Authentication > Settings where you select the Protocol Support. It allows you to select HTTP and HTTPS, but not a specific port.
Did you try changing your http port or adding a new port under : Policy & objects - Policy - Proxy Option ?
Maybe adding port 3000 to the HTTP protocol would help.
Create a test profile and make sure you apply this profile to the appropriate policy under proxy options.
Let us know.
Thanks,
Thanks for your response. That was my initial thought too. After I read your post, I went back and looked and realized I had not configured it correctly. I believe I have everything set right now and it's still not working. The proxy settings appear to only work with the Web Filtering and not the authentication. Below is what the debug looks like. My mobile device is 10.2.8.238 and I'm trying to connect to a server with IP address 10.1.3.136 on port 3000. I have a security policy (155) that allows port 3000 from the 10.2.8 network to the 10.1.3 network. I have selected the default web filter and then chosen a proxy that has HTTP set to port 3000.
id=20085 trace_id=6744 func=print_pkt_detail line=4368 msg="vd-fpp received a packet(proto=6, 10.2.8.238:49255->10.1.3.136:3000) from vlan.lamposwn. flag
recheck that firewall policy 155
Fortinet got back to me with the solution on this. I would have never found it. I already tried it and it works great. Hope it's helpful for someone else.
Hello, Thank you for contacting Fortinet TAC. My name is Phil and I will be assisting you with this ticket. To have the FortiGate present a login page on alternate ports, it can be added from the CLI: # config user setting # config auth-ports # edit <auth-table-entry-id> Use 0 for a new entry # set port <port_int> # set type {ftp | http | https | telnet} Choose HTTP or HTTPS for webpages # end # end
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1634 | |
1063 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.