Not applicable
Created on 04-01-2009 03:03 AM
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
how to limit concurrent login
I have Fortigate 800Fand want to know if there any way that limit
simultaneous login for PPTP VPN and Web-based authentication. I mean
i want to prevent users of giviving their passwords to others and
limit concurrent login to 1.
11 REPLIES 11
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i am sure this isnt possible, as their is no way to track when someone has stopped using their session. plus you have to remember that IE itself would default to four concurrent TCP sessions with just one browser open.
You are better to let everyone know the company official internet usage policy, and say its against this. if evidence is found that it has been given out, then there access will be removed.
then check what IP' s each user is coming from and chase any that seem to be coming from more than one.
UK Based Technical Consultant
FCSE v2.5
FCSE v2.8
FCNSP v3
Specialising in Systems, Apps, SAN Storage and Networks, with over 25 Yrs IT experience.
UK Based Technical Consultant FCSE v2.5 FCSE v2.8 FCNSP v3 Specialising
in Systems, Apps, SAN Storage and Networks, with over 25 Yrs IT
experience.
Not applicable
Created on 04-01-2009 09:54 AM
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
First, i should say thanks for your response.
I am sure this is possible, technically. For example, cisco (via SecureACS) and linux do it easily by identifying " simultaneous-use" criteria in user or group properties.
I want to know if Fortinet support this and how does it.
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Those situation you' ve mentioned rely on external authentication mechanisms,
non-native firewall feature.
If you define PPTP users locally to FortiGate, it' s not possible control simultaneous login as ukwizard pointed out.
If you can rely on external auth like radius and that radius implementation support " simultaneous-use" (not many can do that) you could give it a shot.
regards
/ Abel
regards
/ Abel
Not applicable
Created on 04-01-2009 11:13 PM
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you abel,
i will try it. i hope it works.
Not applicable
Created on 04-02-2009 03:32 AM
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Testing with freeRadius and NTTack shows that fortigate can' t do this. i hope Fortinet add this feature very soon.
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Testing with freeRadius and NTTack shows that fortigate can' t do this. i hope Fortinet add this feature very soon.It' s not a fortigate task to do; all the double-auth check is done in radius server, so it' s a topic to solve from radius server side; i.e. Radiator server, from australian company Open, is a non-free radius server that can check multiple logins within RADIUS active users (non FGT) and block concurrent logins. It' s the radius server that deny the auth is the user is already in its table; there' s no ' disconnect' features (so you cannot disconnect an user issuing commands from radius server) and those things, because the FTG it' s not a network access server (nas) talking with radius server. Check within Fortinet docs for radius dictionary attributes available. There' re new ones with each firmware version. regards
regards
/ Abel
regards
/ Abel
Not applicable
Created on 04-03-2009 01:41 AM
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i now use freeRadius and poptop as my vpn server, and they support each other dictionary, and simultaneous-use works correctly; but fortigate 800F can' t do it with FreeRadius. Also, in FTG Knowledge Center , there is not sufficient information about this subject.
I hope FortiOs 4 solve this problem.
Thank you for your response.
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I doubt that v4 will have any pptp changes.
The way i see it is, the auth server is only contacted to authenticate the server. When they user logs off i do not think there is any mechanism for the fortinet to tell the auth server they have. hence it cannot track them.
Thats how i see it, is that what you are saying abelio?
UK Based Technical Consultant
FCSE v2.5
FCSE v2.8
FCNSP v3
Specialising in Systems, Apps, SAN Storage and Networks, with over 25 Yrs IT experience.
UK Based Technical Consultant FCSE v2.5 FCSE v2.8 FCNSP v3 Specialising
in Systems, Apps, SAN Storage and Networks, with over 25 Yrs IT
experience.
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I doubt that v4 will have any pptp changes.agree; pptp is going to deprecated state with time (not only under FTG)
The way i see it is, the auth server is only contacted to authenticate the server. When they user logs off i do not think there is any mechanism for the fortinet to tell the auth server they have. hence it cannot track them. Thats how i see it, is that what you are saying abelio?Almost. Radius maintain its own table of authenticated users; there' s no a mechanism that allow radius to receive a notification from FTG when user disconnects. Radius server could detect detect a new access from that user and deny it if that user lives within authenticated usertable. So, under such limited scenario, is useless. However, another radius settings or conditions could you enable cleaning authenticated users from the table and make the scenari more usable.
regards
/ Abel
regards
/ Abel