Hot!Radius remote user groups

New Member
  • Total Posts : 1
  • Scores: 0
  • Reward points: 0
  • Joined: 2021/08/03 13:14:36
  • Status: offline
2021/08/03 13:25:03 (permalink)

Radius remote user groups

Hey guys,

I'm trying to create firewall rules based off Radius groups. The end goal is to firewall VPN traffic, certain user groups are allowed to internal resources, and other user groups are only allowed to the internet, etc.

The problem I'm having is understanding how to match the remote group name on my RADIUS server (Windows NPS). As I understand it, in Users & Authentication > User Groups > Remote Groups, my Remote Radius server works currently and user authentication works, but when I enter a "Group Name" that matches that of a group of Windows AD, authentication fails. 

When I pcap on Windows server, it generates an "access-accept" still, so I think the fortigate is comparing "group-name" strings inside of an AVP and is failing when it receives the access-accept.
If anyone has advice, a known tutorial, written documentation, or another method for accomplishing the same goal, I would much appreciate it. 


1 Reply Related Threads

    Expert Member
    • Total Posts : 606
    • Scores: 163
    • Reward points: 0
    • Joined: 2015/02/02 03:22:58
    • Location: EMEA
    • Status: offline
    Re: Radius remote user groups 2021/08/03 23:34:02 (permalink)
    I hope that this KB might clarify a bit what RADIUS group match on FortiOS is.

    Tom xSilver, planet Earth, over and out!
    Jump to:
    © 2021 APG vNext Commercial Version 5.5