Helpful ReplyHot!User is a member of multiple groups

Author
Post
Essentials Only Full Version
LoRa
New Member
  • Total Posts : 3
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/06/22 03:56:51
  • Status: offline
2018/06/22 04:42:13 (permalink) 5.4
0

User is a member of multiple groups

Hello,
 
we are currently in the process of buying a FG-500E. I have a question regarding groups and web filter profile usage:
 
We are planning on using agent-based FSSO and creating multiple AD-Groups that can be assigned to users to manage their internet access. A user can be a member of multiple groups. I can create multiple authentication rules, each of them having different Web Filter policies.
 
Authentication Rule 1: group A - Webfilter Profile A (full access)
Authentication Rule 2: group B - Webfilter Profile B (allow test.de)
Authentication Rule 3: group C - Webfilter Profile C (allow testing.de)
Authentication Rule 4: group D (normal user)  - Webfilter Profile D (restricted access (deny test.de + deny testing.de + allow fortinet.com))
 
If a user is in group A and group D, only Authentication Rule 1 is used. If a user is only in group D, only Authentication Rule 4 is used.
 
What happens, if a user is in group B and D? Will he have access to *.test.de and additionally the sites listed in Webfilter Profile D? Or will he only have access to test.de?
 
I hope everything was understandable...
 
Thanks!
#1
List Solutions Only

7 Replies Related Threads
    rwpatterson
    Expert Member
    • Total Posts : 8404
    • Scores: 195
    • Reward points: 0
    • Joined: 2006/08/08 10:08:18
    • Location: Long Island, New York, USA
    • Status: online
    Re: User is a member of multiple groups 2018/06/22 06:26:15 (permalink) ☄ Helpfulby LoRa 2018/06/25 04:28:24
    0
    Welcome to the forums.
     
    Policies are read from the top down, so if in multiple groups, the first good 'hit' gets the traffic.

    -Bob - self proclaimed posting junkie!
    See my Fortigate related scripts at: http://fortigate.camerabob.com

    -4.3.19-b0694
    FWF60B
    FWF80CM (4)
    FWF81CM (2)
     
    #2
    LoRa
    New Member
    • Total Posts : 3
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/06/22 03:56:51
    • Status: offline
    Re: User is a member of multiple groups 2018/06/22 11:43:15 (permalink)
    0
    Thank you!
     
    So if I understand you correctly only the first authentication rule for each user group will be applied and the user won't be able to access sites allowed in Authentication rules further down the policy list?
     
    In an old Forefront TMG we could simply add a new rule allowing only some users to access site xy, additionally to the rules defining the access every user has. They of course were only applied if they were above the default access policy. Is there a way to implement this in FortiOS? (Except copying our standard webfilter profile and adding the additionally required access for each access group?)
    post edited by LoRa - 2018/06/22 11:44:34
    #3
    LoRa
    New Member
    • Total Posts : 3
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/06/22 03:56:51
    • Status: offline
    Re: User is a member of multiple groups 2018/06/25 04:28:00 (permalink)
    0
    So I stumbled upon this post: https://forum.fortinet.com/tm.aspx?m=155861 which led me to "Multiple group enforcement support" in: http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-authentication-54/UserGroups.htm 
     
    It seems that I will be able to create mutliple groups + multiple authentication and web filter security profiles using the by default enabled feature "auth-multi-group". The authentication policies should cascade and I should only have to be careful with the order in which I create the authentication policies.
     
    Is this correct?
    #4
    zhunissov4
    Gold Member
    • Total Posts : 256
    • Scores: 25
    • Reward points: 0
    • Joined: 2015/10/12 04:00:01
    • Status: offline
    Re: User is a member of multiple groups 2018/06/25 20:22:15 (permalink)
    0
    Hello, 
     
    Yes, better will be use multiple user groups + security  profiles.  Also, you should be careful with the order of these policies. 
     
     
    #5
    dimi.kala
    New Member
    • Total Posts : 1
    • Scores: 0
    • Reward points: 0
    • Joined: 2018/07/30 06:08:09
    • Status: offline
    Re: User is a member of multiple groups 2018/07/30 06:11:28 (permalink)
    0
    Hello,
     
    It seems that this feature is gone in 5.6.5 and 6.0.* although it is still listed in the CLI Reference Guide for FortiOS 6.0. We are running 500E's with 5.6.5 and this command is not available in CLI.
    Could someone confirm this?
     
     
    #6
    helderjag
    New Member
    • Total Posts : 3
    • Scores: 0
    • Reward points: 0
    • Joined: 2019/01/17 02:03:57
    • Status: offline
    Re: User is a member of multiple groups 2019/01/27 16:00:36 (permalink)
    0
    Hi,
     
    I have the exact same issue, those anyone found a solution?
    In the CLI reference guide for 5.6 it says the command was removed
    http://help.fortinet.com/...onfig/user/setting.htm
    #7
    ThomasK
    New Member
    • Total Posts : 9
    • Scores: 2
    • Reward points: 0
    • Joined: 2019/03/22 05:04:03
    • Status: offline
    Re: User is a member of multiple groups 2019/07/17 06:23:43 (permalink)
    0
    Hi,
     
    after talking to the FortiGate support: The command was removed, because its enabled by default.
    But, there is a bug in FortiGate 6.0.2 and up, that only one group of a user is used.
     
    Can be checked via: diag firewall auth list
     
    FortiGate 6.2 is also affected. Its announced, that it will be fixed with 6.0.6.
     
    Best,
    Thomas
    #8
    Jump to:
    © 2019 APG vNext Commercial Version 5.5