Fortinet v3.0 MR7 manual SSL VPN user groups, Protection profiles

Page 40

User groups

Users/peers and user groups

Note: You cannot use Directory Service user groups directly in FortiGate firewall policies. You must add Directory Service groups to FortiGate user groups. A Directory Service group should belong to only one FortiGate user group. If you assign it to multiple FortiGate user groups, the FortiGate unit recognizes only the last user group assignment.

For a Directory Service user group, the Directory Service server authenticates users when they log on to the network. The FortiGate unit receives the user’s name and IP address from the FSAE collector agent. For more information about FSAE, see the FSAE Technical Note.

A Directory Service user group provides access to a firewall policy that requires Directory Service type authentication and lists the user group as one of the allowed groups. The members of the user group are Directory Service users or groups that you select from a list that the FortiGate unit receives from the Directory Service servers that you have configured. See “Directory Service servers” on page 27.

Note: A Directory Service user group cannot have SSL VPN access.

For more information about users and user groups, see the FortiGate

Administration Guide.

SSL VPN user groups

An SSL VPN user group provides access to a firewall policy that requires SSL VPN type authentication and lists the user group as one of the allowed groups. Local user accounts, LDAP, and RADIUS servers can be members of an SSL VPN user group. The FortiGate unit requests the user’s user name and password when the user accesses the SSL VPN web portal. The user group settings include options for SSL VPN features.

An SSL VPN user group can also provide access to an IPSec VPN for dialup users. In this case, the IPSec VPN phase 1 configuration uses the Accept peer ID in dialup group peer option. You configure the user’s VPN client with the user name as peer ID and the password as pre-shared key. The user can connect successfully to the IPSec VPN only if the user name is a member of the allowed user group and the password matches the one stored on the FortiGate unit.

Protection profiles

Note: A user group cannot be an IPSec dialup group if any member is authenticated using a RADIUS or LDAP server.

Each user group is associated with a protection profile to determine the antivirus, web filtering, spam filtering, logging, and intrusion protection settings that apply to the authenticated connection. The FortiGate unit contains several pre-configured protection profiles and you can create your own as needed.

When you create or modify any firewall policy, you can select a protection profile. If the firewall policy requires authentication, its own protection profile is disabled and the authentication user group protection profile applies.

Note: Protection profiles do not apply to VPN connections.

 

FortiOS v3.0 MR7 User Authentication User Guide

40

01-30007-0347-20080828

Page 39 Page 41
Image 40
Page 39 Page 41
Contents E R G U I D E FortiOS v3.0 MR7 User Authentication User Guide TrademarksContents Configuring authenticated access Users/peers and user groupsIndex Creating local users Creating peer usersAbout authentication IntroductionWeb-based user authentication User’s view of authenticationVPN client-based authentication FortiGate administrator’s view of authentication See Creating local users on See Creating peer users onAuthentication servers See Configuring user groups onPublic Key Infrastructure PKI authentication PeersUsers User groupsAuthentication timeout About this documentFirewall policies VPN tunnelsFortiGate documentation Name field, type adminTypographic conventions FortiGate Administration Guide Related documentationFortiManager documentation FortiClient documentationFortiMail documentation FortiAnalyzer documentationCustomer service and technical support Fortinet Tools and Documentation CDFortinet Knowledge Center Comments on Fortinet technical documentationAuthentication servers Radius serversConfiguring the FortiGate unit to use a Radius server Radius attributes sent in Radius accounting messagePrimary Server Name/IP Primary Server SecretEdit icon Edit a Radius server configuration GroupLdap servers Ldapsearch -x objectclass= Configuring the FortiGate unit to use an Ldap server Password Server PortCommon Name IdentifierTo configure the FortiGate unit for Ldap authentication CLI EditProtocol CertificateUsing the Query icon Ldap server Distinguished Name Query treeTACACS+ servers AsciiAuthentication Type Server KeyDirectory Service servers Create New DomainGroups Fsae Collector IPDirectory Service server configuration Name Fsae Collector IP/Name PortCLI Example Directory Service server list Directory Service servers Users/peers and user groups Users/peersCreating local users User type AuthenticationTo create a local user web-based manager Go to User Local Delete icon Edit icon To view a list of all local users, go to User LocalTo create a local user CLI Creating peer users To remove a user from the FortiGate unit configuration CLIDelete icon To view a list of PKI peer users, go to User PKI Authenticating peer user Subject To create a peer user for PKI authentication CLI Remove PKI peer userUser groups Directory Service user groupsFirewall user groups SSL VPN user groups Protection profilesSelect Create New and enter the following information Configuring user groupsFirewall Configuring Directory Service user groups To create a firewall user group CLIMembers FortiGuard WebConfiguring SSL VPN user groups Available Users/Groups or Available MembersConfiguring Peer user groups Viewing a list of user groupsTo create a peer group CLI Group NameConfig user group delete groupname End User groups Authentication timeout Authentication protocolsEnter the Idle Timeout value seconds Select Apply TelnetFirewall policy authentication Authentication SettingsConfiguring authentication for a firewall policy Authentication is an Advanced firewall optionTo configure authentication for a firewall policy Go to Firewall PolicyFirewall policy order Firewall Policy Move ToSource Interface Configuring authenticated access to the InternetZone VPN authentication Configuring authentication of SSL VPN usersSelect Enable SSL-VPN and enter information as follows Go to VPN SSLDefault RC4128 Server CertificateRequire Client Certificate Encryption Key AlgorithmTo configure authentication for an SSL VPN CLI Configuring authentication of VPN peers and clients Configuring authentication of Pptp VPN users/user groupsSelect Enable Pptp Select Require Client Certificate, and then select ApplyConfiguring authentication of L2TP VPN users/user groups Configuring authentication of remote IPSec VPN usersTo configure authentication for a Pptp VPN CLI To configure authentication for an L2TP VPN CLIOnly users with passwords on the FortiGate unit To configure user group authentication for dialup IPSec CLIRemote Gateway Configuring XAuth authentication IPSec configuration for dialup usersTo configure authentication for a dialup IPSec VPN CLI Remote Gateway Authentication MethodXAuth Server TypeVPN authentication Index 01-30007-0347-20080731 MS-CHAP VSA
Top Page Image Contents