Fortinet v3.0 MR7 manual Firewall policy order, Firewall Policy Move To

Page 50

Firewall policy authentication

Configuring authenticated access

7One at a time, select user group names from the Available Groups list and select the right-pointing arrow button to move them to the Allowed list. All members of the groups in the Allowed list will be authenticated with this firewall policy.

8To use a CA certificate for authentication, in Certificate, select the certificate to use from the drop-down list.

9To require the user to accept a disclaimer to connect to the destination, select User Authentication Disclaimer.

The User Authentication Disclaimer replacement message is displayed. You can edit the User Authentication Disclaimer replacement message text by going to System > Config > Replacement Messages.

10Type a URL in Redirect URL if the user is to be redirected after they are authenticated or accept the disclaimer.

11Select OK.

Firewall policy order

The firewall policies that you create must be correctly placed in the policy list to be effective. The firewall evaluates a connection request by checking the policy list from the top down, looking for the first policy that matches the source and destination addresses of the packet. Keep these rules in mind:

•More specific policies must be placed above more general ones.

•Any policy that requires authentication must be placed above any similar policy that does not.

•If a user fails authentication, the firewall drops the request and does not check for a match with any of the remaining policies.

•If you create a policy that requires authentication for HTTP access to the Internet, you must precede this policy with a policy for unauthenticated access to the appropriate DNS server.

To change the position of the DNS server in the policy list - web-based manager

1Go to Firewall > Policy.

2If necessary, expand the list to view your policies.

3Select the Move To icon beside the DNS policy you created.

Figure 24: Firewall > Policy - Move To

Move To

Delete

Edit

Insert Policy before

	FortiOS v3.0 MR7 User Authentication User Guide
50	01-30007-0347-20080828

Image 50

Contents E R G U I D E FortiOS v3.0 MR7 User Authentication User Guide TrademarksContents Index Configuring authenticated accessUsers/peers and user groups Creating local users Creating peer usersAbout authentication IntroductionVPN client-based authentication User’s view of authenticationWeb-based user authentication FortiGate administrator’s view of authentication See Creating local users on See Creating peer users onAuthentication servers See Configuring user groups onUsers Public Key Infrastructure PKI authenticationPeers User groupsFirewall policies Authentication timeoutAbout this document VPN tunnelsTypographic conventions Name field, type adminFortiGate documentation FortiGate Administration Guide Related documentationFortiMail documentation FortiManager documentationFortiClient documentation FortiAnalyzer documentationFortinet Knowledge Center Customer service and technical supportFortinet Tools and Documentation CD Comments on Fortinet technical documentationAuthentication servers Radius serversConfiguring the FortiGate unit to use a Radius server Radius attributes sent in Radius accounting messagePrimary Server Name/IP Primary Server SecretEdit icon Edit a Radius server configuration GroupLdap servers Ldapsearch -x objectclass= Configuring the FortiGate unit to use an Ldap server Common Name PasswordServer Port IdentifierProtocol To configure the FortiGate unit for Ldap authentication CLIEdit CertificateUsing the Query icon Ldap server Distinguished Name Query treeTACACS+ servers AsciiAuthentication Type Server KeyDirectory Service servers Groups Create NewDomain Fsae Collector IPDirectory Service server configuration Name Fsae Collector IP/Name PortCLI Example Directory Service server list Directory Service servers Users/peers and user groups Users/peersTo create a local user web-based manager Go to User Local User type AuthenticationCreating local users To create a local user CLI To view a list of all local users, go to User LocalDelete icon Edit icon Delete icon To remove a user from the FortiGate unit configuration CLICreating peer users Subject Authenticating peer userTo view a list of PKI peer users, go to User PKI To create a peer user for PKI authentication CLI Remove PKI peer userFirewall user groups Directory Service user groupsUser groups SSL VPN user groups Protection profilesFirewall Configuring user groupsSelect Create New and enter the following information Members Configuring Directory Service user groupsTo create a firewall user group CLI FortiGuard WebConfiguring SSL VPN user groups Available Users/Groups or Available MembersTo create a peer group CLI Configuring Peer user groupsViewing a list of user groups Group NameConfig user group delete groupname End User groups Enter the Idle Timeout value seconds Select Apply Authentication timeout Authentication protocols TelnetFirewall policy authentication Authentication SettingsTo configure authentication for a firewall policy Configuring authentication for a firewall policyAuthentication is an Advanced firewall option Go to Firewall PolicyFirewall policy order Firewall Policy Move ToZone Configuring authenticated access to the InternetSource Interface Select Enable SSL-VPN and enter information as follows VPN authenticationConfiguring authentication of SSL VPN users Go to VPN SSLRequire Client Certificate Default RC4128Server Certificate Encryption Key AlgorithmTo configure authentication for an SSL VPN CLI Select Enable Pptp Configuring authentication of VPN peers and clientsConfiguring authentication of Pptp VPN users/user groups Select Require Client Certificate, and then select ApplyTo configure authentication for a Pptp VPN CLI Configuring authentication of L2TP VPN users/user groupsConfiguring authentication of remote IPSec VPN users To configure authentication for an L2TP VPN CLIRemote Gateway To configure user group authentication for dialup IPSec CLIOnly users with passwords on the FortiGate unit Configuring XAuth authentication IPSec configuration for dialup usersXAuth To configure authentication for a dialup IPSec VPN CLIRemote Gateway Authentication Method Server TypeVPN authentication Index 01-30007-0347-20080731 MS-CHAP VSA