Is is possible to separate domain users from guests?
I'd like to give all non-domain users in a specific VLAN Internet only access, while domain users (or domain-joined PC's) can access internal resources as well. My plan is to apply this VLAN to meeting rooms and other areas where guests can be expected to connect their PC's.
I've followed this instruction: https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/731999/fsso-in-polling-mode-for-windows-ad
Well, it doesn't work. Everything looks OK in the FW, but I get internet only access when I connect my PC.
Never mind my current config, my question is: Is it even possible to implement my scenario? The users may or may not have signed in to the domain before plugging in their laptop in the meeting room. The PC is domain-joined, the user is a domain user, but may be logged in with cached credentials.