What' s the best way to restrict Internet access by user groups?

[sakpgu]

Greetings Experts: --Help. I' m a consultant who recently inherited an Internet lock down project for an important client from two colleagues who left our firm before finishing said project. It' s quite a mess; the client is peeved; I' m confused (and irked at my former co-workers). --The goal is to have three levels of Internet access based on user groups. What is the best way to do this? It looks like most of the configuration is done (see Notes below) except for the actual policies. -- Do I need the FortiClient? I didn' t see a way to accomplish my goals with firewall policies or UTM, etc., after reading through the 4.0 admin guide as well as the FSAE guide and the knowledge base. --I' m relatively new to advanced Fortigate configurations. However, I have setup other Fortigates to restrict Internet access globally with firewall policies and FortiGuard services. --Please let me know if you need more info. I' m grateful for any and all advice. Patrick NOTES --Goal: Group 1 = Allow all Group 2 = Allow all, blacklist a few sites Group 3 = Deny all, but white list a few sites --Device Info: Fortigate 100A (OS 4.0 MR1 Patch 4) --Config Info: AD Security Groups created. FSAE installed (LDAP mode) on Win 2K3 DC. Local, Directory Service and User Groups created on the 100A.

[rwpatterson]

Welcome to the forums. If the user groups are already created, and the policies are set up, just create custom protection profiles, and drop them into the policies. The PPs do the actual filtering. Within them you set the levels of Internet access, logging, etc. for the policies they are in. Hope that helps.

[sakpgu]

Hi Bob: --Thanks for the assist. Your quick response means I have to address this Monday and can' t stall the client. Seriously, I' ll play with the protection profiles and post back the results. I don' t think all of the policies are setup but it shouldn' t be too hard to sort that out. All the best, Patrick

[sakpgu]

Hi Bob: --No joy. I' m still unclear how to deny Internet access for some users except for a few select sites. Is there a walk through etc. for setting up policies, protection profiles, white/black lists for use with FSAE? Also, Does FSAE require authentication for accounts that are allowed to use the Internet or accounts to block from Internet? --I suspect I' m doing something wrong but I' m not sure where (policies?). Here' s what I attempted: -Added URL filter with specific websites, set to allow. -Enabled Web filtering in a new protection profile; set to use newly-created URL filter. -Added FSAE authentication policy as per admin guide; added HTTP and HTTPS services; applied newly-created protection profile; applied policy to LAN>WAN. --Logged into test PC with account not part of directory service group; successfully accessed Internet. --Logged into test PC with account that belonged to directory service group; successfully accessed Internet. --If I understood the admin guide correctly, I shouldn' t have been able to access the Internet (save for the white list) when logged in with an account not subject to FSAE authentication. --Please let me know if you need more info. Thanks in advance for the help. Patrick

[rwpatterson]

When you log onto a denied PC, check under " user > Monitor" and find the policy that' s allowing Internet access. Make sure it' s the one you designated for that purpose. Policies are enacted from the top down, so the first good one gets the traffic. Make your scopes as granular as possible so that someone cannot inadvertently surf via another wide scoped policy.

[sakpgu]

Hi Bob: --I' ve opened a ticket with support and will work with them to resolve the issue. Thanks again for the advice. All the best, P.

[laf]

Are you using Identity base policies?

[sakpgu]

--Yes. We' re pulling the info from Windows AD.