Web Filter precedence with membership to multiple groups

[McWoodley]

Hi all, I looked through the forum and searched but couldn' t find anything on this topic. I am going to be setting up web filtering based off of active directory group membership. This will be on a Fortigate 100D running v5.0,build4429 What I need to know is how group membership will be treated. Will it be the most restrictive or the most permissive. I need to know how I should approach setting up policies. A new default policy that is very restrictive and then groups to allow access. Or a liberal policy then restrict based on groups. What happens if the user is a member of multiple groups, does the most permissive setting applied or the most restrictive? Thanks!

[HA]

Hello, Identity policy search is done from top to down. If a user is member of multiple groups, the first policy (so Web filter profile, Application control profile, etc) matching the group' s member will be applied. That' s pretty easy... Regards, HA

[McWoodley]

Thanks for the reply. That makes sense but I guess I am still not clear on how not to include a category so another rule can process it. It is my understanding that the way you can setup profiles you have the options to Allow, block, monitor, warning, authenticate. Say I have a restrictive rule at the bottom that blocks everything. I then have a rule above it that allows basic access to domain users. Then I have a rule at the top that allows streaming media. Below that I have a rule that allows shopping. I want to have a user that is allowed to stream media but not shop and vice versa a user that I want to allow to shop but not stream media. I don' t see how I can exclude categories when setting up a profile. So for example the rule that only allows the additional access of streaming media what would I set the level to for all other categories. I am guessing the permissive results cumulative? So if the user is a member of streaming media and all else is blocked that users is tagged for streaming media, it hits another rule that allows shopping but has all else blocked then they are tagged to allow both streaming and shopping? So to verify is it the most permissive rule that is applied correct?

[HA]

Hello, You need to understand first how the firewall match a rule. 1. Source IP 2. Destination IP (OR specific FQN like www.fortinet.com, NOT domain name) 3. Destination port 4. Optional : Group Membership. Once a match occurs, session is created and the traffic flow always use that rule (so WF Profile, Application control profile, etc applied to that rule). In your case, you wants to match an URL filter (like shopping) ! It' s not possible because the destination URL category cannot be defined in step two. " I don' t see how I can exclude categories when setting up a profile" Not possible ! " I am guessing the permissive results cumulative?" false. First match in the policy apply I' m also working with Palo Alto and they support such kind of config... Regards, HA

[McWoodley]

Thanks again for your reply. I have also verified with support that only singular group membership is supported. I have to say this is very disappointing. I would have expected more from a " Next Generation" Firewall. We will have to rethink the way we wish to deploy. Palo Alto was my first choice but corporate had already invested in Foritgates which are working well. We just hadn' t used them as a web proxy.

[McWoodley]

OK I am still learning this platform. What about within the web filter profile, instead of choosing allow, block or monitor you choose authenticate? Then set that to a group that the user would be in? Seem that this would accomplish what I am looking to do. I think I just need to open a ticket and talk to one of their engineers:)

[Bromont_FTNT]

You set up groups on AD to send to the Fortigate... All users should fall into one of those groups. On the Fortigate you create multiple webfilter profile.... One webfilter profile would have just shopping, another just streaming and another would have both (for example) Then in the firewall policy (identiy based) you assign those profile to the different user groups.

[Bromont_FTNT]

Yes... open a ticket would be best to get everything sorted out

[HA]

Hello, Bromont, it means that for every URL Categrory, you need to create an AD groups, put each AD users into, and create ID rules. What a management nightmare ?? Regards, HA

[Bromont_FTNT]

HA, Not sure what you mean, however let' s take the example of a school... You have Students, Teachers and Admins. For webfiltering everyone will be a member of one of those groups in AD. The collector agent is configured to send those 3 groups to the Fortigate. Now on the Fortigate you' ll create 3 different webfilter profiles: Admins have access to everything. No restrictions. Teachers have Adult/Mature and Security risk blocked Students have Adult/Mature, Security Risk, Bandwidth Consuming and Social Networking Blocked. Now create 1 User Identity firewall policy (internal interface --> Internet) Under authentication rules you' ll create 3 rules for your 3 groups and apply the appropriate webfilter profiles