Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
student1363
New Contributor

can fortigate do these

hi,

I am going to buy a fortigate 100 series (not decided specifically on model). What I really need to know is whether it support "reverse proxy" or not. I want it between internet and my webserver (I know about the foriweb, but I am tight in budget and want other fortigate features like IPS as well).

Another question is, does fortigate need any license for HA?

my last question is, can fortigate get authentication info from users ( for services that need it like email or sharepoint) and give it to server; if authentication was successful user will be directed to server.

 

thanks in advance

1 Solution
aagrafi

To create a user based policy, first you create users/user groups (User & Device > User Definition/User Groups). Then you go to the desired policy and select source (Policy & Objects > IPv4 Policy > Source). There FG allows you to enter source address objects and user objects. Selecting user you can input the users/user groups you created before.

 

You can also use LDAP for user authentication.

 

The above example is from 5.4. In other FortiOS versions the procedure might be slightly different.

View solution in original post

4 REPLIES 4
aagrafi
Contributor II

Yes, reverse proxy WAF functionality is supported in the FG. You'll need to purchase the WAF FortiGuard license at least. Also have in mind that WAF in the FG is strictly signature based.

 

HA does not need any special license, BUT all FGs in the cluster must have exactly the same FortiGuard licenses. Even if the cluster is active-standby, you need FortiGuard licenses for both FGs.

 

I don't quite understand the last question, but I think the functionality you are looking for looks like user based firewall policies. If so, then yes, this is supported. Please clarify.

student1363

aagrafi wrote:

 

I don't quite understand the last question, but I think the functionality you are looking for looks like user based firewall policies. If so, then yes, this is supported. Please clarify.

Thanks aagrafi 

Yes, you understood right. I want policies base on username. but I can't find where in IPv4 policy can I add user/group? I can't add it as source.

 

In addition, how the FG gets authentication info from users?

 

ede_pfau

Identity based policies are configured differently in the various FortiOS versions. Tell us yours and we can be more specific. Or you can find the relevant information in the FortiOS Handbook.

 

Auth is bound to fgt, telnet or http as the user has to interact with the FGT.

A different way is to use FSSO (single sign on), using a client listening on a DC which relays the user's login status to the FGT.

Ede Kernel panic: Aiee, killing interrupt handler!
Ede Kernel panic: Aiee, killing interrupt handler!
aagrafi

To create a user based policy, first you create users/user groups (User & Device > User Definition/User Groups). Then you go to the desired policy and select source (Policy & Objects > IPv4 Policy > Source). There FG allows you to enter source address objects and user objects. Selecting user you can input the users/user groups you created before.

 

You can also use LDAP for user authentication.

 

The above example is from 5.4. In other FortiOS versions the procedure might be slightly different.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors