Transparent Proxy Kerberos Auth with Captive Portal does not work!

[thrillseeker]

Hi all,

I recently configured Transparent Proxy Kerberos Auth (FOS 5.6.4) according to the following link:

http://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-WAN-opt/web_proxy.htm?cshid=policy_pr...

I also setup a test domain-controller (Win2016) and domain joined test client (win10).

When try to access the internet from the test client I see in the browser the redirect to the FG captive portal, configured on port 10443.

Unfortunetely the FG does not respond on this port.

When running a diagonose debug flow I will get:

id=20085 trace_id=190 func=init_ip_session_common line=5470 msg="allocate a new session-00081811" id=20085 trace_id=190 func=vf_ip_route_input_common line=2576 msg="find a route: flag=84000000 gw-192.168.2.1 via root" id=20085 trace_id=190 func=fw_local_in_handler line=402 msg="iprope_in_check() check failed on policy 0, drop"

Somehow the client request to the captive portal will be blocked by the FG local-in policy. When I check the local-in policy I see that TCP/10443 is allowed. What can I do to get more information about this issue on the FG?

Kerberos Config:

config authentication setting set captive-portal "tproxy.thrillnet.local" set captive-portal-port 10443 end

config authentication rule edit "kerberos-auth" set srcaddr "h_192.168.2.101_winclient" set ip-based disable set active-auth-method "kerberos-schema" set web-auth-cookie enable next end

config authentication scheme edit "kerberos-schema" set method negotiate set negotiate-ntlm disable next end

config user krb-keytab edit "http_service" set principal "HTTP/tproxy.thrillnet.local@THRILLNET.LOCAL" set ldap-server "WINSRV" set keytab "BQIAAABGAAIAD1RIUklMTE5FVC5MT0NBTAAESFRUUAAWdHByb3h5LnRocmlsbG5ldC5sb2NhbAAAAAEAAAAAAwABAAgCDqGhcMHLugAAAEYAAgAPVEhSSUxMTkVULkxPQ0FMAARIVFRQABZ0cHJveHkudGhyaWxsbmV0LmxvY2FsAAAAAQAAAAADAAMACAIOoaFwwcu6AAAATgACAA9USFJJTExORVQuTE9DQUwABEhUVFAAFnRwcm94eS50aHJpbGxuZXQubG9jYWwAAAABAAAAAAMAFwAQ0uxS/NKvngOcUQ7y9q572QAAAF4AAgAPVEhSSUxMTkVULkxPQ0FMAARIVFRQABZ0cHJveHkudGhyaWxsbmV0LmxvY2FsAAAAAQAAAAADABIAIHqd+oGNYNcxvx/+hzY3Hc8I/igYt2aNkwnTZgLA36cpAAAATgACAA9USFJJTExORVQuTE9DQUwABEhUVFAAFnRwcm94eS50aHJpbGxuZXQubG9jYWwAAAABAAAAAAMAEQAQtdjtljVfT1zgiYsh3YnxWg==" next end

config user ldap edit "WINSRV" set server "192.168.2.100" set cnid "sAMAccountName" set dn "cn=users,dc=thrillnet,dc=local" set type regular set username "cn=Administrator,cn=users,dc=thrillnet,dc=local" set password ENC  next end

Proxy-Config:

onfig firewall proxy-policy edit 1 set uuid aa1adc5e-5a0c-51e8-a320-8d50a120593b set proxy transparent-web set srcintf "ThrillNet" set dstintf "wan1" set srcaddr "h_192.168.2.101_winclient" set dstaddr "all" set service "webproxy" set action accept set schedule "always" set groups "grp_webusers" set transparent enable set utm-status enable set av-profile "my-av-scan" set profile-protocol-options "tproxy" set ssl-ssh-profile "certificate-inspection" next end

Firewall Policy:

edit 13 set name "tproxy" set uuid 581d3556-5a06-51e8-5a72-d99af9dab0ce set srcintf "ThrillNet" set dstintf "wan1" set srcaddr "h_192.168.2.101_winclient" set dstaddr "all" set action accept set schedule "always" set service "HTTP" "HTTPS" set utm-status enable set av-profile "my-av-scan" set profile-protocol-options "tproxy" set ssl-ssh-profile "certificate-inspection" set nat enable next

config firewall profile-protocol-options edit "tproxy" config http set ports 80 8080 unset options set http-policy enable unset post-lang end

Thanks a lot for any feedback.

Regards

Thrillseeker

[Fishbone_FTNT]

Hi Thrillseeker,

there are 2 things worth to check:

1/ you need to enable wad kerberos captive portal on interface, ie:

config system interface

    edit port2

        set proxy-captive-portal enable

    next

end

2/ check if tcp/10443 doesn't somehow collide with sslvpn

Regards,

 Fishbone)(

[thrillseeker]

Hi Fishbone,

Thanks for your feedback.

I already had the proxy-captive-portal option enabled on the interface (WLAN Interface/SSID).

I also changed the captive-portal-port to 9998 but does not change anything.

When I test on my Windows 10 domain-joined client using the F12 developer options in IE I see the following HTTP 303 Redirect from the FGT towards the captive portal:

http://tproxy.thrillnet.local:9998/XX/YY/ZZ/ckauth?scheme=http&.....

But then after the redirect the request timed out.

My test client is in the same LAN than the FGT, so the request to the captive portal will definitely not be blocked somewhere else.

Also did a "diag sniffer packet" for my captive-portal:

diagnose sniffer packet any 'port 9998' interfaces=[any] filters=[port 9998] 

8.318555 192.168.2.101.59162 -> 192.168.2.1.9998: syn 2556788221 9.336369 192.168.2.101.59162 -> 192.168.2.1.9998: syn 2556788221 11.337993 192.168.2.101.59162 -> 192.168.2.1.9998: syn 2556788221

Also when doing a "diag packet flow":

FWF61Exxxxxx # id=20085 trace_id=208 func=print_pkt_detail line=5311 msg="vd-root received a packet(proto=6, 192.168.2.101:59673->192.168.2.1:9998) from ThrillNet. flag , seq 2245569318, ack 0, win 65535" id=20085 trace_id=208 func=init_ip_session_common line=5470 msg="allocate a new session-001097e8" id=20085 trace_id=208 func=vf_ip_route_input_common line=2576 msg="find a route: flag=84000000 gw-192.168.2.1 via root" id=20085 trace_id=208 func=fw_local_in_handler line=402 msg="iprope_in_check() check failed on policy 0, drop"

According to this the request will be blocked by implied rule policy 0.

To be on the save side I enabled local-in policy like this towards the transparent proxy FGT interface (192.168.2.1) for all sources and protocols:

WF61Exxxxxxxxxx (local-in-policy) # show full-configuration config firewall local-in-policy edit 1 set ha-mgmt-intf-only disable set intf "ThrillNet" set srcaddr "all" set dstaddr "h_192.168.2.1_fw" set action accept set service "ALL" set schedule "always" set status enable next end

Any other suggestions?

Thanks & Regards

Thrillseeker

[Paul_S]

You look like you have done your homework and troubleshooted this issue well. Have you opened a support ticket?

[thrillseeker]

Hi Paul,

Thanks, I just opened a support ticket right now.

Keep you posted.

Regards

Thrillseeker

[jkettu]

Hi,

Did you get an answer to this case, as I'm having exactly the same issue at the moment.

/J

[goleon]

Hi all,

I have the same issue.

Can you give me your solution fort this problem please?

[SteveRoadWarrior]

I have a similar issue with web based authentication. 

Most authentication pages do not function on 6.0.x, have not yet found a combination which works.

Issue is that we can't get past the redirection page back to the original destination after authentication happens.

Have an open case with TAC on 6.0.x firmware.  Have confirmed on multiple firewalls, multiple models, several firmware revisions in the 6.0.x branch, including the latest 6.0.4.

[goleon]

tahnk you for your reply but now i have into 5.6.6 firmware version and not to 6.x.

An other idea?