Web Filtering and FSSO

[Liza1]

If I want to create a policy where an AD user, for example USER1, cannot access a specific website like Facebook. Is there a guide on how to create a firewall policy like this: Source: USER1 Dest All Web Filtering: Block_Facebook? I really need specific instructions on this. I am using FSSO in Fortigate. This user is From AD DOMAIN CONTROLLER

#FortiGate 

[ozkanaltas]

Hello @Liza1 ,

Actually there is no big difference in FSSO rule configuration. If your FSSO service works properly, you need to add the FSSO user group to the source area in the rule configuration. I couldn't find anything directly about it but I tried to show it on my firewall configuration.Also you can review this document for FSSO. 

https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/576158/configuring-fsso-fire...

 

[Liza1]

i write this is it right? but i dont have traffic in this policy. maybe its problem of FSSO connection with AD server?

 

[ozkanaltas]

Hello @Liza1 ,

Your configuration is correct but I think your user object is wrong. Normally, FSSO user icon should be like this.

When I reviewed your screenshot, I saw your user object is a local user. This user type needs active authentication. Because of that, you can't use this user object for FSSO. 

To create an FSSO user, you can follow this document. 

https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/576158/configuring-fsso-fire...

[Shashwati]

Configure local user group using FSSO user group and user that local firewall user group on the Firewall policy