User is a member of multiple groups

[LoRa]

Hello,

we are currently in the process of buying a FG-500E. I have a question regarding groups and web filter profile usage:

We are planning on using agent-based FSSO and creating multiple AD-Groups that can be assigned to users to manage their internet access. A user can be a member of multiple groups. I can create multiple authentication rules, each of them having different Web Filter policies.

Authentication Rule 1: group A - Webfilter Profile A (full access)

Authentication Rule 2: group B - Webfilter Profile B (allow test.de)

Authentication Rule 3: group C - Webfilter Profile C (allow testing.de)

Authentication Rule 4: group D (normal user)  - Webfilter Profile D (restricted access (deny test.de + deny testing.de + allow fortinet.com))

If a user is in group A and group D, only Authentication Rule 1 is used. If a user is only in group D, only Authentication Rule 4 is used.

What happens, if a user is in group B and D? Will he have access to *.test.de and additionally the sites listed in Webfilter Profile D? Or will he only have access to test.de?

I hope everything was understandable...

Thanks!

[rwpatterson · Accepted solution]

Welcome to the forums.

Policies are read from the top down, so if in multiple groups, the first good 'hit' gets the traffic.

[LoRa]

Thank you!

So if I understand you correctly only the first authentication rule for each user group will be applied and the user won't be able to access sites allowed in Authentication rules further down the policy list?

In an old Forefront TMG we could simply add a new rule allowing only some users to access site xy, additionally to the rules defining the access every user has. They of course were only applied if they were above the default access policy. Is there a way to implement this in FortiOS? (Except copying our standard webfilter profile and adding the additionally required access for each access group?)

[LoRa]

So I stumbled upon this post: https://forum.fortinet.com/tm.aspx?m=155861 which led me to "Multiple group enforcement support" in: http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-authentication-54/UserGroups.htm 

It seems that I will be able to create mutliple groups + multiple authentication and web filter security profiles using the by default enabled feature "auth-multi-group". The authentication policies should cascade and I should only have to be careful with the order in which I create the authentication policies.

Is this correct?

[dimi_kala]

Hello,

It seems that this feature is gone in 5.6.5 and 6.0.* although it is still listed in the CLI Reference Guide for FortiOS 6.0. We are running 500E's with 5.6.5 and this command is not available in CLI.

Could someone confirm this?

[helderjag]

Hi,

I have the exact same issue, those anyone found a solution?

In the CLI reference guide for 5.6 it says the command was removed

http://help.fortinet.com/...onfig/user/setting.htm

[ThomasK]

Hi,

after talking to the FortiGate support: The command was removed, because its enabled by default.

But, there is a bug in FortiGate 6.0.2 and up, that only one group of a user is used.

Can be checked via: diag firewall auth list

FortiGate 6.2 is also affected. Its announced, that it will be fixed with 6.0.6.

Best,

Thomas