Page 2 - FortiOS v3.0 MR7 User Authentication User Guide; Trademarks
FortiOS v3.0 MR7 User Authentication User Guide 28 Aug 2008 01-30007-0347-20080828 © Copyright 2008 Fortinet, Inc. All rights reserved. No part of this publication including text, examples, diagrams or illustrations may be reproduced, transmitted, or translated in any form or by any means, electroni...
Page 3 - Contents
Contents FortiOS v3.0 MR7 User Authentication User Guide01-30007-0347-20080828 3 Contents Introduction ........................................................................................ 5 About authentication ........................................................................................
Page 5 - Introduction; About authentication
Introduction About authentication FortiOS v3.0 MR7 User Authentication User Guide01-30007-0347-20080828 5 Introduction This section introduces you to the authentication process from the user and the administrators perspective, and provides supplementary information about Fortinet publications. The f...
Page 6 - User’s view of authentication; Web-based user authentication
FortiOS v3.0 MR7 User Authentication User Guide 6 01-30007-0347-20080828 User’s view of authentication Introduction User’s view of authentication The user sees a request for authentication when they try to access a protected resource. The way in which the request is presented to the user depends on ...
Page 7 - FortiGate administrator’s view of authentication; See
Introduction FortiGate administrator’s view of authentication FortiOS v3.0 MR7 User Authentication User Guide01-30007-0347-20080828 7 FortiClient can store the user name and password for a VPN as part of the configuration for the VPN connection and pass them to the FortiGate unit as needed. Or, Fort...
Page 8 - Authentication servers
FortiOS v3.0 MR7 User Authentication User Guide 8 01-30007-0347-20080828 FortiGate administrator’s view of authentication Introduction 3 Create user groups. Add local/peer user members to each user group as appropriate. You can also add an authentication server to a user group. In this case, all use...
Page 9 - Public Key Infrastructure (PKI) authentication; Users; “Users/peers” on page 33; User groups; FortiGate Administration
Introduction FortiGate administrator’s view of authentication FortiOS v3.0 MR7 User Authentication User Guide01-30007-0347-20080828 9 Public Key Infrastructure (PKI) authentication A Public Key Infrastructure (PKI) is a comprehensive system of policies, processes, and technologies working together t...
Page 10 - Authentication timeout; User; “Authentication timeout” on page 47; Firewall policies; FortiGate Administration Guide; VPN tunnels; FortiGate PPTP VPN User Guide,; About this document; Document conventions
FortiOS v3.0 MR7 User Authentication User Guide 10 01-30007-0347-20080828 About this document Introduction Authentication timeout An authenticated connection expires when it has been idle for a length of time that you specify. The authentication timeout value set in User > Authentication > Aut...
Page 11 - Notes and Cautions are used to provide important information:; Typographic conventions; FortiGate documentation; Fortinet Technical Documentation; In the Name field, type; FortiGate
Introduction FortiGate documentation FortiOS v3.0 MR7 User Authentication User Guide01-30007-0347-20080828 11 • In the examples, private IP addresses are used for both private and public IP addresses. • Notes and Cautions are used to provide important information: Typographic conventions FortiGate d...
Page 12 - Provides a context-sensitive and searchable version of the; Related documentation
FortiOS v3.0 MR7 User Authentication User Guide 12 01-30007-0347-20080828 Related documentation Introduction • FortiGate Administration Guide Provides basic information about how to configure a FortiGate unit, including how to define FortiGate protection profiles and firewall policies; how to apply ...
Page 13 - FortiManager documentation; FortiClient documentation; Provides a searchable version of the; FortiAnalyzer documentation; Provides a searchable version of the
Introduction Related documentation FortiOS v3.0 MR7 User Authentication User Guide01-30007-0347-20080828 13 FortiManager documentation • FortiManager QuickStart Guide Explains how to install the FortiManager Console, set up the FortiManager Server, and configure basic settings. • FortiManager System...
Page 14 - Fortinet Tools and Documentation CD; Fortinet Knowledge Center; Fortinet; Comments on Fortinet technical documentation; Customer service and technical support; Please visit the
FortiOS v3.0 MR7 User Authentication User Guide 14 01-30007-0347-20080828 Customer service and technical support Introduction Fortinet Tools and Documentation CD All Fortinet documentation is available from the Fortinet Tools and Documentation CD shipped with your Fortinet product. The documents on ...
Page 15 - This section describes:; RADIUS servers; The RADIUS server user database can be any combination of:
Authentication servers RADIUS servers FortiOS v3.0 MR7 User Authentication User Guide01-30007-0347-20080828 15 Authentication servers FortiGate units support the use of authentication servers. If you are going to use FortiGate authentication servers, you must configure the servers before you configu...
Page 16 - Fortinet’s dictionary is configured this way:; Configuring the FortiGate unit to use a RADIUS server; or
FortiOS v3.0 MR7 User Authentication User Guide 16 01-30007-0347-20080828 RADIUS servers Authentication servers In order to support vendor-specific attributes (VSA), the RADIUS server requires a dictionary to define what the VSAs are. Fortinet’s dictionary is configured this way: ## Fortinet’s VSA’s...
Page 17 - config system global
Authentication servers RADIUS servers FortiOS v3.0 MR7 User Authentication User Guide01-30007-0347-20080828 17 • Change the FortiGate unit default RADIUS port to 1645 using the CLI: config system global set radius_port 1645 end To configure the FortiGate unit for RADIUS authentication - web-based ma...
Page 18 - To configure the FortiGate unit for RADIUS authentication - CLI; config user radius; Create New
FortiOS v3.0 MR7 User Authentication User Guide 18 01-30007-0347-20080828 RADIUS servers Authentication servers To configure the FortiGate unit for RADIUS authentication - CLI config user radius edit <server_name> set all-usergroup {enable | disable } set auth-type <authentication_protocol&...
Page 19 - LDAP servers; anonymous - bind using anonymous user search
Authentication servers LDAP servers FortiOS v3.0 MR7 User Authentication User Guide01-30007-0347-20080828 19 To remove a RADIUS server from the FortiGate unit configuration - CLI config user radius delete <server_name> end LDAP servers Lightweight Directory Access Protocol (LDAP) is an Interne...
Page 20 - ldapsearch
FortiOS v3.0 MR7 User Authentication User Guide 20 01-30007-0347-20080828 LDAP servers Authentication servers FortiGate LDAP does not support proprietary functionality, such as notification of password expiration, which is available from some LDAP servers. FortiGate LDAP does not supply information ...
Page 21 - objectClass: organizationalUnit; Configuring the FortiGate unit to use an LDAP server; Go to
Authentication servers LDAP servers FortiOS v3.0 MR7 User Authentication User Guide01-30007-0347-20080828 21 The output is lengthy, but the information you need is in the first few lines: version: 2 # # filter: (objectclass=*) # requesting: ALL # dn: dc=example,dc=com dc: example objectClass: top ob...
Page 23 - To configure the FortiGate unit for LDAP authentication - CLI; config user ldap; Delete
Authentication servers LDAP servers FortiOS v3.0 MR7 User Authentication User Guide01-30007-0347-20080828 23 To configure the FortiGate unit for LDAP authentication - CLI config user ldap edit <server_name> set cnid <common_name_identifier> set dn <distinguished_name> set port <...
Page 24 - Using the Query icon; Figure 5: LDAP server Distinguished Name Query tree; Edit icon
FortiOS v3.0 MR7 User Authentication User Guide 24 01-30007-0347-20080828 LDAP servers Authentication servers To remove an LDAP server from the FortiGate unit configuration - CLI config user ldap delete <server_name> end Using the Query icon The LDAP Distinguished Name Query list displays the ...
Page 25 - ASCII
Authentication servers TACACS+ servers FortiOS v3.0 MR7 User Authentication User Guide01-30007-0347-20080828 25 TACACS+ servers In recent years, remote network access has shifted from terminal access to LAN access. Users are now connecting to their corporate network (using notebooks or home PCs) wit...
Page 26 - To configure the FortiGate unit for TACACS+ authentication - CLI; end; Name; Authentication Type
FortiOS v3.0 MR7 User Authentication User Guide 26 01-30007-0347-20080828 TACACS+ servers Authentication servers Figure 6: TACACS+ server configuration To configure the FortiGate unit for TACACS+ authentication - CLI config user tacacs+ edit <server_name> set auth-type {ascii | auto | chap | m...
Page 27 - Directory Service servers; The FSAE has two components that you must install on your network:
Authentication servers Directory Service servers FortiOS v3.0 MR7 User Authentication User Guide01-30007-0347-20080828 27 To remove a TACACS+ server from the FortiGate unit configuration - CLI config user tacacs+ delete <server_name> end Directory Service servers Windows Active Directory (AD) ...
Page 28 - To view the list of Directory Service servers, go to; User > Directory Service; Configuring the FortiGate unit to use a Directory Service server
FortiOS v3.0 MR7 User Authentication User Guide 28 01-30007-0347-20080828 Directory Service servers Authentication servers To view the list of Directory Service servers, go to User > Directory Service . Figure 8: Example Directory Service server list Configuring the FortiGate unit to use a Direct...
Page 29 - For more information about FSAE, see the; and select Create New.
Authentication servers Directory Service servers FortiOS v3.0 MR7 User Authentication User Guide01-30007-0347-20080828 29 For more information about FSAE, see the FSAE Technical Note . To configure the FortiGate unit for Directory Service authentication - web-based manager 1 Go to User > Director...
Page 30 - config user fsae; and select the
FortiOS v3.0 MR7 User Authentication User Guide 30 01-30007-0347-20080828 Directory Service servers Authentication servers To remove a Directory Service server from the FortiGate unit configuration - web-based manager 1 Go to User > Directory Service . 2 Select the Delete icon beside the name of ...
Page 33 - Users/peers and user groups; and
Users/peers and user groups Users/peers FortiOS v3.0 MR7 User Authentication User Guide01-30007-0347-20080828 33 Users/peers and user groups FortiGate authentication controls system access by user group. First you configure users/peers, then you create user groups and add users/peers to them. • Conf...
Page 34 - “Authentication; Creating local users; To define a local user you need:; To create a local user - web-based manager; User type
FortiOS v3.0 MR7 User Authentication User Guide 34 01-30007-0347-20080828 Users/peers Users/peers and user groups This section describes how to configure local users and peer users. For information about configuration of authentication servers see “Authentication servers” on page 15 . Creating local...
Page 35 - To view a list of all local users, go to; To create a local user - CLI; config user local
Users/peers and user groups Users/peers FortiOS v3.0 MR7 User Authentication User Guide01-30007-0347-20080828 35 To view a list of all local users, go to User > Local . Figure 13: Local user list To create a local user - CLI config user local edit <user_name> set type password set passwd &l...
Page 36 - To remove a user from the FortiGate unit configuration - CLI; Creating peer users; To define a peer user you need:; Delete icon
FortiOS v3.0 MR7 User Authentication User Guide 36 01-30007-0347-20080828 Users/peers Users/peers and user groups config user local edit <user_name> set type ldap set ldap_server <server_name> end or config user local edit <user_name> set type radius set radius_server <server_na...
Page 37 - a peer user name; To create a peer user for PKI authentication - web-based manager
Users/peers and user groups Users/peers FortiOS v3.0 MR7 User Authentication User Guide01-30007-0347-20080828 37 • a peer user name • the text from the subject field of the certificate of the authenticating peer user, or the CA certificate used to authenticate the peer user. You can configure a peer...
Page 38 - To create a peer user for PKI authentication - CLI; config user peer; Figure 17: Remove PKI peer user; Note
FortiOS v3.0 MR7 User Authentication User Guide 38 01-30007-0347-20080828 Users/peers Users/peers and user groups To create a peer user for PKI authentication - CLI config user peer edit <peer name> set subject <subject_string> set ca <ca_cert_string> end To remove a PKI peer user ...
Page 39 - A user group is a list of user/peer identities. An identity can be:; Firewall user groups; “Adding authentication to firewall policies” on page 286; Directory Service user groups
Users/peers and user groups User groups FortiOS v3.0 MR7 User Authentication User Guide01-30007-0347-20080828 39 User groups A user group is a list of user/peer identities. An identity can be: • a local user account (user name/password) stored on the FortiGate unit • a local user account with the pa...
Page 40 - FSAE Technical Note; SSL VPN user groups
FortiOS v3.0 MR7 User Authentication User Guide 40 01-30007-0347-20080828 User groups Users/peers and user groups For a Directory Service user group, the Directory Service server authenticates users when they log on to the network. The FortiGate unit receives the user’s name and IP address from the ...
Page 41 - For more information about protection profiles, see the; Configuring user groups; To create a Firewall user group - web-based manager
Users/peers and user groups User groups FortiOS v3.0 MR7 User Authentication User Guide01-30007-0347-20080828 41 For more information about protection profiles, see the FortiGate Administration Guide . Configuring user groups You create a user group by typing a name, selecting users and/or authentic...
Page 42 - To create a firewall user group - CLI; config user group; Configuring Directory Service user groups; To create an Directory Service user group; Select Create New, enter the following information, and select OK.
FortiOS v3.0 MR7 User Authentication User Guide 42 01-30007-0347-20080828 User groups Users/peers and user groups 3 Select OK. To create a firewall user group - CLI config user group edit <group_name> set group-type <grp_type> set member <user1> <user2> ... <user n > se...
Page 43 - Configuring SSL VPN user groups; FortiGate SSL VPN User Guide
Users/peers and user groups User groups FortiOS v3.0 MR7 User Authentication User Guide01-30007-0347-20080828 43 Figure 19: User group configuration - Directory Service Configuring SSL VPN user groups For detailed instructions about how to configure SSL VPN web-only mode or tunnel mode operation, se...
Page 44 - Configuring Peer user groups; To create a peer group - CLI; Viewing a list of user groups
FortiOS v3.0 MR7 User Authentication User Guide 44 01-30007-0347-20080828 User groups Users/peers and user groups Configuring Peer user groups Peer user groups can only be configured using the CLI. Peers are digital certificate holders defined using the config user peer command. You use the peer gro...
Page 45 - Figure 21: Remove user group; To remove a user group from the FortiGate unit configuration - CLI
Users/peers and user groups User groups FortiOS v3.0 MR7 User Authentication User Guide01-30007-0347-20080828 45 To remove a user group from the FortiGate unit configuration - web-based manager 1 Go to User > User Group . 2 Select the Delete icon beside the name of the user group that you want to...
Page 47 - Configuring authenticated access
Configuring authenticated access Authentication timeout FortiOS v3.0 MR7 User Authentication User Guide01-30007-0347-20080828 47 Configuring authenticated access When you have configured authentication servers, users, and user groups, you are ready to configure firewall policies and certain types of...
Page 48 - To set the authentication protocols; Firewall policy authentication
FortiOS v3.0 MR7 User Authentication User Guide 48 01-30007-0347-20080828 Firewall policy authentication Configuring authenticated access When user authentication is enabled on a firewall policy, the authentication challenge is normally issued for any of the four protocols (dependent on the connecti...
Page 49 - Configuring authentication for a firewall policy; Authentication is an Advanced firewall option.; To configure authentication for a firewall policy; Create users and one or more Firewall user groups.
Configuring authenticated access Firewall policy authentication FortiOS v3.0 MR7 User Authentication User Guide01-30007-0347-20080828 49 The style of the authentication method varies by the authentication protocol. If you have selected HTTP, FTP or Telnet, user name and password-based authentication...
Page 50 - Firewall policy order; More specific policies must be placed above more general ones.
FortiOS v3.0 MR7 User Authentication User Guide 50 01-30007-0347-20080828 Firewall policy authentication Configuring authenticated access 7 One at a time, select user group names from the Available Groups list and select the right-pointing arrow button to move them to the Allowed list. All members o...
Page 51 - Configuring authenticated access to the Internet; precede; the policy for Internet access.
Configuring authenticated access Firewall policy authentication FortiOS v3.0 MR7 User Authentication User Guide01-30007-0347-20080828 51 The FortiGate unit performs authentication only on requests to access HTTP, HTTPS, FTP, and Telnet. Once the user is authenticated, the user can access other servi...
Page 52 - VPN authentication; FortiGate IPSec VPN User Guide; Configuring authentication of SSL VPN users; To configure authentication for an SSL VPN - web-based manager; “Users/peers and user groups” on page 33; Tunnel IP Range
FortiOS v3.0 MR7 User Authentication User Guide 52 01-30007-0347-20080828 VPN authentication Configuring authenticated access VPN authentication All VPN configurations require users to authenticate. Authentication based on user groups applies to: • SSL VPNs • PPTP and L2TP VPNs • an IPSec VPN that a...
Page 54 - To configure authentication for an SSL VPN - CLI; Configuring strong authentication of SSL VPN users/user groups
FortiOS v3.0 MR7 User Authentication User Guide 54 01-30007-0347-20080828 VPN authentication Configuring authenticated access To configure authentication for an SSL VPN - CLI config vpn ssl settings set algorithm set auth-timeout set dns-server1 set dns-server2 set idle-timeout set portal-heading se...
Page 55 - To enable strong authentication for an SSL VPN; Configuring authentication of VPN peers and clients; To configure authentication for a PPTP VPN - web-based manager
Configuring authenticated access VPN authentication FortiOS v3.0 MR7 User Authentication User Guide01-30007-0347-20080828 55 To enable strong authentication for an SSL VPN 1 Go to VPN > SSL > Config . 2 Select Require Client Certificate, and then select Apply. 3 Go to Firewall > Policy . 4 ...
Page 56 - To configure authentication for a PPTP VPN - CLI; For detailed information about configuring PPTP, see the; Configuring authentication of L2TP VPN users/user groups; To configure authentication for an L2TP VPN - CLI; For more information, see the; Configuring authentication of remote IPSec VPN users
FortiOS v3.0 MR7 User Authentication User Guide 56 01-30007-0347-20080828 VPN authentication Configuring authenticated access 4 Enter Starting IP and Ending IP addresses. This defines the range of addresses assigned to VPN clients. 5 Select the user group that is to have access to this VPN. The Fort...
Page 57 - To configure user group authentication for dialup IPSec - CLI; config vpn ipsec phase1; Remote Gateway; Peer Options
Configuring authenticated access VPN authentication FortiOS v3.0 MR7 User Authentication User Guide01-30007-0347-20080828 57 2 Go to VPN > IPSec > Auto Key (IKE), select Create Phase 1 and enter the following information. Figure 28: Configure VPN IPSec dialup authentication 3 Select Advanced t...
Page 58 - Configuring XAuth authentication; For more information, see
FortiOS v3.0 MR7 User Authentication User Guide 58 01-30007-0347-20080828 VPN authentication Configuring authenticated access Configuring XAuth authentication Extended Authentication (XAuth) increases security by requiring additional user authentication in a separate exchange at the end of the VPN P...
Page 59 - Configure other VPN gateway parameters as needed.; To configure authentication for a dialup IPSec VPN - CLI; XAuth; Server Type
Configuring authenticated access VPN authentication FortiOS v3.0 MR7 User Authentication User Guide01-30007-0347-20080828 59 3 Select Advanced to reveal additional parameters and enter the following information. 4 Configure other VPN gateway parameters as needed. 5 Select OK. For more information ab...
Page 61 - Index
Index FortiOS v3.0 MR7 User Authentication User Guide01-30007-0347-20080731 61 Index A Active Directory - see Directory Serviceadministrator authentication 7 ASCII 25attributes RADIUS 15 authenticated access configuring 47 authenticating users FortiGate 33with LDAP servers 34with RADIUS servers 34wi...
Fortinet 1000A-LENC
Manual
Fortinet ADM-FB8
Manual
Fortinet 224B
Manual
Fortinet 3810A-LENC
Manual
Fortinet 05DS693
Manual
Fortinet 2 SXRC
Manual
Fortinet 3600A
Manual
Fortinet 2002F
Manual
Fortinet 3016B
Manual
Fortinet ASM-CE4
Manual
Fortinet FortiDB-400B
Manual
Fortinet KS13
Manual
Fortinet FortiLog-800
Manual
Fortinet 400
Manual
Fortinet FortiDB-1000B
Manual
Fortinet ASM-FX2
Manual