Hot!Transparent Proxy Kerberos Auth with Captive Portal does not work!

Author
thrillseeker
New Member
  • Total Posts : 20
  • Scores: 0
  • Reward points: 0
  • Joined: 2016/10/24 08:39:28
  • Status: offline
2018/05/19 12:14:47 (permalink) 5.6
0

Transparent Proxy Kerberos Auth with Captive Portal does not work!

Hi all,
I recently configured Transparent Proxy Kerberos Auth (FOS 5.6.4) according to the following link:
http://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-WAN-opt/web_proxy.htm?cshid=policy_protocol_newedit
 
I also setup a test domain-controller (Win2016) and domain joined test client (win10).
When try to access the internet from the test client I see in the browser the redirect to the FG captive portal, configured on port 10443.
 
Unfortunetely the FG does not respond on this port.
When running a diagonose debug flow I will get:
id=20085 trace_id=190 func=init_ip_session_common line=5470 msg="allocate a new session-00081811"
id=20085 trace_id=190 func=vf_ip_route_input_common line=2576 msg="find a route: flag=84000000 gw-192.168.2.1 via root"
id=20085 trace_id=190 func=fw_local_in_handler line=402 msg="iprope_in_check() check failed on policy 0, drop"


Somehow the client request to the captive portal will be blocked by the FG local-in policy. When I check the local-in policy I see that TCP/10443 is allowed. What can I do to get more information about this issue on the FG?
 
Kerberos Config:
 
config authentication setting
set captive-portal "tproxy.thrillnet.local"
set captive-portal-port 10443
end
 
config authentication rule
edit "kerberos-auth"
set srcaddr "h_192.168.2.101_winclient"
set ip-based disable
set active-auth-method "kerberos-schema"
set web-auth-cookie enable
next
end
 
config authentication scheme
edit "kerberos-schema"
set method negotiate
set negotiate-ntlm disable
next
end
 
 
config user krb-keytab
edit "http_service"
set principal "HTTP/tproxy.thrillnet.local@THRILLNET.LOCAL"
set ldap-server "WINSRV"
set keytab "BQIAAABGAAIAD1RIUklMTE5FVC5MT0NBTAAESFRUUAAWdHByb3h5LnRocmlsbG5ldC5sb2NhbAAAAAEAAAAAAwABAAgCDqGhcMHLugAAAEYAAgAPVEhSSUxMTkVULkxPQ0FMAARIVFRQABZ0cHJveHkudGhyaWxsbmV0LmxvY2FsAAAAAQAAAAADAAMACAIOoaFwwcu6AAAATgACAA9USFJJTExORVQuTE9DQUwABEhUVFAAFnRwcm94eS50aHJpbGxuZXQubG9jYWwAAAABAAAAAAMAFwAQ0uxS/NKvngOcUQ7y9q572QAAAF4AAgAPVEhSSUxMTkVULkxPQ0FMAARIVFRQABZ0cHJveHkudGhyaWxsbmV0LmxvY2FsAAAAAQAAAAADABIAIHqd+oGNYNcxvx/+hzY3Hc8I/igYt2aNkwnTZgLA36cpAAAATgACAA9USFJJTExORVQuTE9DQUwABEhUVFAAFnRwcm94eS50aHJpbGxuZXQubG9jYWwAAAABAAAAAAMAEQAQtdjtljVfT1zgiYsh3YnxWg=="
next
end
 
config user ldap
edit "WINSRV"
set server "192.168.2.100"
set cnid "sAMAccountName"
set dn "cn=users,dc=thrillnet,dc=local"
set type regular
set username "cn=Administrator,cn=users,dc=thrillnet,dc=local"
set password ENC 
next
end
 
Proxy-Config:
 
onfig firewall proxy-policy
edit 1
set uuid aa1adc5e-5a0c-51e8-a320-8d50a120593b
set proxy transparent-web
set srcintf "ThrillNet"
set dstintf "wan1"
set srcaddr "h_192.168.2.101_winclient"
set dstaddr "all"
set service "webproxy"
set action accept
set schedule "always"
set groups "grp_webusers"
set transparent enable
set utm-status enable
set av-profile "my-av-scan"
set profile-protocol-options "tproxy"
set ssl-ssh-profile "certificate-inspection"
next
end
 
Firewall Policy:
edit 13
set name "tproxy"
set uuid 581d3556-5a06-51e8-5a72-d99af9dab0ce
set srcintf "ThrillNet"
set dstintf "wan1"
set srcaddr "h_192.168.2.101_winclient"
set dstaddr "all"
set action accept
set schedule "always"
set service "HTTP" "HTTPS"
set utm-status enable
set av-profile "my-av-scan"
set profile-protocol-options "tproxy"
set ssl-ssh-profile "certificate-inspection"
set nat enable
next
 
config firewall profile-protocol-options
edit "tproxy"
config http
set ports 80 8080
unset options
set http-policy enable
unset post-lang
end
 
 
Thanks a lot for any feedback.
Regards
Thrillseeker
 
 
 
 
 
 
post edited by thrillseeker - 2018/05/19 12:20:31
#1

8 Replies Related Threads

    Fishbone_FTNT
    Gold Member
    • Total Posts : 57
    • Scores: 27
    • Reward points: 0
    • Joined: 2015/02/02 02:13:08
    • Status: offline
    Re: Transparent Proxy Kerberos Auth with Captive Portal does not work! 2018/05/23 00:12:33 (permalink)
    0
    Hi Thrillseeker,
    there are 2 things worth to check:
    1/ you need to enable wad kerberos captive portal on interface, ie:
    config system interface
        edit port2
            set proxy-captive-portal enable
        next
    end
    2/ check if tcp/10443 doesn't somehow collide with sslvpn
     
    Regards,
     Fishbone)(
    #2
    thrillseeker
    New Member
    • Total Posts : 20
    • Scores: 0
    • Reward points: 0
    • Joined: 2016/10/24 08:39:28
    • Status: offline
    Re: Transparent Proxy Kerberos Auth with Captive Portal does not work! 2018/05/24 14:13:25 (permalink)
    0
    Hi Fishbone,
     
    Thanks for your feedback.
    I already had the proxy-captive-portal option enabled on the interface (WLAN Interface/SSID).
    I also changed the captive-portal-port to 9998 but does not change anything.
     
    When I test on my Windows 10 domain-joined client using the F12 developer options in IE I see the following HTTP 303 Redirect from the FGT towards the captive portal:
    http://tproxy.thrillnet.local:9998/XX/YY/ZZ/ckauth?scheme=http&.....
     
    But then after the redirect the request timed out.
    My test client is in the same LAN than the FGT, so the request to the captive portal will definitely not be blocked somewhere else.
     
    Also did a "diag sniffer packet" for my captive-portal:
     
    diagnose sniffer packet any 'port 9998'
    interfaces=[any]
    filters=[port 9998] 
    8.318555 192.168.2.101.59162 -> 192.168.2.1.9998: syn 2556788221
    9.336369 192.168.2.101.59162 -> 192.168.2.1.9998: syn 2556788221
    11.337993 192.168.2.101.59162 -> 192.168.2.1.9998: syn 2556788221
     
    Also when doing a "diag packet flow":
     
    FWF61Exxxxxx # id=20085 trace_id=208 func=print_pkt_detail line=5311 msg="vd-root received a packet(proto=6, 192.168.2.101:59673->192.168.2.1:9998) from ThrillNet. flag , seq 2245569318, ack 0, win 65535"
    id=20085 trace_id=208 func=init_ip_session_common line=5470 msg="allocate a new session-001097e8"
    id=20085 trace_id=208 func=vf_ip_route_input_common line=2576 msg="find a route: flag=84000000 gw-192.168.2.1 via root"
    id=20085 trace_id=208 func=fw_local_in_handler line=402 msg="iprope_in_check() check failed on policy 0, drop"
     
    According to this the request will be blocked by implied rule policy 0.
    To be on the save side I enabled local-in policy like this towards the transparent proxy FGT interface (192.168.2.1) for all sources and protocols:
     
    WF61Exxxxxxxxxx (local-in-policy) # show full-configuration
    config firewall local-in-policy
    edit 1
    set ha-mgmt-intf-only disable
    set intf "ThrillNet"
    set srcaddr "all"
    set dstaddr "h_192.168.2.1_fw"
    set action accept
    set service "ALL"
    set schedule "always"
    set status enable
    next
    end
     
    Any other suggestions?
    Thanks & Regards
    Thrillseeker
     
     
     
     
    #3
    Paul S
    Gold Member
    • Total Posts : 168
    • Scores: 8
    • Reward points: 0
    • Joined: 2011/05/02 16:49:52
    • Status: offline
    Re: Transparent Proxy Kerberos Auth with Captive Portal does not work! 2018/05/24 14:41:51 (permalink)
    0
    You look like you have done your homework and troubleshooted this issue well. Have you opened a support ticket?

    FG200D 5.6.5 (HA) - primary
    FWF50B' s 4.3.x, FG60D's 5.2.x, FG60E's 5.4.x                   [Did my post help you? Please rate my post.]
    FAZ-VM 5.6.5  |  Fortimail 5.3.11
    Network+, Security+
    #4
    thrillseeker
    New Member
    • Total Posts : 20
    • Scores: 0
    • Reward points: 0
    • Joined: 2016/10/24 08:39:28
    • Status: offline
    Re: Transparent Proxy Kerberos Auth with Captive Portal does not work! 2018/05/24 14:55:30 (permalink)
    0
    Hi Paul,
     
    Thanks, I just opened a support ticket right now.
    Keep you posted.
     
    Regards
    Thrillseeker
    #5
    jkettu
    New Member
    • Total Posts : 1
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/11/01 23:52:29
    • Status: offline
    Re: Transparent Proxy Kerberos Auth with Captive Portal does not work! 2018/11/02 03:26:25 (permalink)
    0
    Hi,
     
    Did you get an answer to this case, as I'm having exactly the same issue at the moment.
     
    /J
    #6
    goleon
    New Member
    • Total Posts : 2
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/02/06 05:45:01
    • Status: offline
    Re: Transparent Proxy Kerberos Auth with Captive Portal does not work! 2019/02/06 05:45:49 (permalink)
    0
    Hi all,
    I have the same issue.
    Can you give me your solution fort this problem please?
    #7
    SteveRoadWarrior
    Silver Member
    • Total Posts : 104
    • Scores: 4
    • Reward points: 0
    • Joined: 2011/06/28 09:03:07
    • Location: east coast USA
    • Status: offline
    Re: Transparent Proxy Kerberos Auth with Captive Portal does not work! 2019/02/06 06:16:39 (permalink)
    0
    I have a similar issue with web based authentication. 
     
    Most authentication pages do not function on 6.0.x, have not yet found a combination which works.
     
    Issue is that we can't get past the redirection page back to the original destination after authentication happens.
     
    Have an open case with TAC on 6.0.x firmware.  Have confirmed on multiple firewalls, multiple models, several firmware revisions in the 6.0.x branch, including the latest 6.0.4.
    #8
    goleon
    New Member
    • Total Posts : 2
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/02/06 05:45:01
    • Status: offline
    Re: Transparent Proxy Kerberos Auth with Captive Portal does not work! 2019/02/08 08:08:09 (permalink)
    0
    tahnk you for your reply but now i have into 5.6.6 firmware version and not to 6.x.
     
    An other idea?
    #9
    Jump to:
    © 2019 APG vNext Commercial Version 5.5