how to limit concurrent login

[#1]

I have Fortigate 800Fand want to know if there any way that limit simultaneous login for PPTP VPN and Web-based authentication. I mean i want to prevent users of giviving their passwords to others and limit concurrent login to 1.

[UkWizard]

i am sure this isnt possible, as their is no way to track when someone has stopped using their session. plus you have to remember that IE itself would default to four concurrent TCP sessions with just one browser open. You are better to let everyone know the company official internet usage policy, and say its against this. if evidence is found that it has been given out, then there access will be removed. then check what IP' s each user is coming from and chase any that seem to be coming from more than one.

[#3]

First, i should say thanks for your response. I am sure this is possible, technically. For example, cisco (via SecureACS) and linux do it easily by identifying " simultaneous-use" criteria in user or group properties. I want to know if Fortinet support this and how does it.

[abelio]

Those situation you' ve mentioned rely on external authentication mechanisms, non-native firewall feature. If you define PPTP users locally to FortiGate, it' s not possible control simultaneous login as ukwizard pointed out. If you can rely on external auth like radius and that radius implementation support " simultaneous-use" (not many can do that) you could give it a shot.

[#5]

Thank you abel, i will try it. i hope it works.

[#6]

Testing with freeRadius and NTTack shows that fortigate can' t do this. i hope Fortinet add this feature very soon.

[abelio]

Testing with freeRadius and NTTack shows that fortigate can' t do this. i hope Fortinet add this feature very soon.

It' s not a fortigate task to do; all the double-auth check is done in radius server, so it' s a topic to solve from radius server side; i.e. Radiator server, from australian company Open, is a non-free radius server that can check multiple logins within RADIUS active users (non FGT) and block concurrent logins. It' s the radius server that deny the auth is the user is already in its table; there' s no ' disconnect' features (so you cannot disconnect an user issuing commands from radius server) and those things, because the FTG it' s not a network access server (nas) talking with radius server. Check within Fortinet docs for radius dictionary attributes available. There' re new ones with each firmware version. regards

[#8]

i now use freeRadius and poptop as my vpn server, and they support each other dictionary, and simultaneous-use works correctly; but fortigate 800F can' t do it with FreeRadius. Also, in FTG Knowledge Center , there is not sufficient information about this subject. I hope FortiOs 4 solve this problem. Thank you for your response.

[UkWizard]

I doubt that v4 will have any pptp changes. The way i see it is, the auth server is only contacted to authenticate the server. When they user logs off i do not think there is any mechanism for the fortinet to tell the auth server they have. hence it cannot track them. Thats how i see it, is that what you are saying abelio?

[abelio]

I doubt that v4 will have any pptp changes.

agree; pptp is going to deprecated state with time (not only under FTG)

The way i see it is, the auth server is only contacted to authenticate the server. When they user logs off i do not think there is any mechanism for the fortinet to tell the auth server they have. hence it cannot track them. Thats how i see it, is that what you are saying abelio?

Almost. Radius maintain its own table of authenticated users; there' s no a mechanism that allow radius to receive a notification from FTG when user disconnects. Radius server could detect detect a new access from that user and deny it if that user lives within authenticated usertable. So, under such limited scenario, is useless. However, another radius settings or conditions could you enable cleaning authenticated users from the table and make the scenari more usable.