Configuring SSL VPN user groups | Fortinet v3.0 MR7 specs


Users/peers and user groups	User groups

Figure 19: User group configuration - Directory Service

Right Arrow



			Left Arrow
Expand Arrow			Left Arrow
Expand Arrow
Name		Type or enter the name of the user group.
Type		Select the user group type:
		Firewall		Select this group in any firewall policy that
				requires Firewall authentication.
		Directory Service Select this group in any firewall policy that
				requires Directory Service authentication.
		SSL VPN		Select this group in any firewall policy with
				Action set to SSL VPN.
				Not available in Transparent mode.
Protection Profile		Available only if Type is Firewall or Directory Service.
		Select a protection profile for this user group from the list. To
		create a new protection profile, select Create New from this list.
		Enter the appropriate information and select OK.

Available Users/Groups or

Available Members*

Members

The list of Local users, RADIUS servers, LDAP servers, TACACS+ servers, Directory Service users/user groups, or PKI users that can be added to the user group. To add a member to this list, select the name and then select the Right Arrow.

* Available Members if user group type is Directory Service.

The list of Local users, RADIUS servers, LDAP servers, TACACS+ servers, Directory Service users/user groups, or PKI users that belong to the user group. To remove a member, select the name and then select the Left Arrow.

FortiGuard Web	Available only if Type is Firewall or Directory Service.
Filtering Override	Configure Web Filtering override capabilities for this group.
SSL-VPN User Group	Available only if Type is SSL VPN.
Options

Configuring SSL VPN user groups

For detailed instructions about how to configure SSL VPN web-only mode or tunnel mode operation, see the FortiGate SSL VPN User Guide.

FortiOS v3.0 MR7 User Authentication User Guide
01-30007-0347-20080828	43

Image 43

Fortinet v3.0 MR7 manual Configuring SSL VPN user groups, Available Users/Groups or Available Members

Contents

E R G U I D E Trademarks FortiOS v3.0 MR7 User Authentication User Guide Contents Creating local users Creating peer users Configuring authenticated accessUsers/peers and user groups Index Introduction About authentication Web-based user authentication User’s view of authenticationVPN client-based authentication See Creating local users on See Creating peer users on FortiGate administrator’s view of authentication See Configuring user groups on Authentication servers User groups Public Key Infrastructure PKI authenticationPeers Users VPN tunnels Authentication timeoutAbout this document Firewall policies FortiGate documentation Name field, type adminTypographic conventions Related documentation FortiGate Administration Guide FortiAnalyzer documentation FortiManager documentationFortiClient documentation FortiMail documentation Comments on Fortinet technical documentation Customer service and technical supportFortinet Tools and Documentation CD Fortinet Knowledge Center Radius servers Authentication servers Radius attributes sent in Radius accounting message Configuring the FortiGate unit to use a Radius server Primary Server Secret Primary Server Name/IP Group Edit icon Edit a Radius server configuration Ldap servers Ldapsearch -x objectclass= Configuring the FortiGate unit to use an Ldap server Identifier PasswordServer Port Common Name Certificate To configure the FortiGate unit for Ldap authentication CLIEdit Protocol Ldap server Distinguished Name Query tree Using the Query icon Ascii TACACS+ servers Server Key Authentication Type Directory Service servers Fsae Collector IP Create NewDomain Groups Fsae Collector IP/Name Port Directory Service server configuration Name CLI Example Directory Service server list Directory Service servers Users/peers Users/peers and user groups Creating local users User type AuthenticationTo create a local user web-based manager Go to User Local Delete icon Edit icon To view a list of all local users, go to User LocalTo create a local user CLI Creating peer users To remove a user from the FortiGate unit configuration CLIDelete icon To view a list of PKI peer users, go to User PKI Authenticating peer userSubject Remove PKI peer user To create a peer user for PKI authentication CLI User groups Directory Service user groupsFirewall user groups Protection profiles SSL VPN user groups Select Create New and enter the following information Configuring user groupsFirewall FortiGuard Web Configuring Directory Service user groupsTo create a firewall user group CLI Members Available Users/Groups or Available Members Configuring SSL VPN user groups Group Name Configuring Peer user groupsViewing a list of user groups To create a peer group CLI Config user group delete groupname End User groups Telnet Authentication timeoutAuthentication protocols Enter the Idle Timeout value seconds Select Apply Authentication Settings Firewall policy authentication Go to Firewall Policy Configuring authentication for a firewall policyAuthentication is an Advanced firewall option To configure authentication for a firewall policy Firewall Policy Move To Firewall policy order Source Interface Configuring authenticated access to the InternetZone Go to VPN SSL VPN authenticationConfiguring authentication of SSL VPN users Select Enable SSL-VPN and enter information as follows Encryption Key Algorithm Default RC4128Server Certificate Require Client Certificate To configure authentication for an SSL VPN CLI Select Require Client Certificate, and then select Apply Configuring authentication of VPN peers and clientsConfiguring authentication of Pptp VPN users/user groups Select Enable Pptp To configure authentication for an L2TP VPN CLI Configuring authentication of L2TP VPN users/user groupsConfiguring authentication of remote IPSec VPN users To configure authentication for a Pptp VPN CLI Only users with passwords on the FortiGate unit To configure user group authentication for dialup IPSec CLIRemote Gateway IPSec configuration for dialup users Configuring XAuth authentication Server Type To configure authentication for a dialup IPSec VPN CLIRemote Gateway Authentication Method XAuth VPN authentication Index 01-30007-0347-20080731 MS-CHAP VSA