Fortinet FortiGate 60M User manual

www.fortinet.com
FortiGate User Authentication
Version 1
USER GUIDE

FortiGate User Authentication Guide
Version 1
25 August 2005
01-28007-0233-20050825
© Copyright 2005 Fortinet, Inc. All rights reserved. No part of this
publication including text, examples, diagrams or illustrations may be
reproduced, transmitted, or translated in any form or by any means,
electronic, mechanical, manual, optical or otherwise, for any purpose,
without prior written permission of Fortinet, Inc.
Trademarks
ABACAS, APSecure, FortiASIC, FortiBIOS, FortiBridge, FortiClient,
FortiGate, FortiGuard, FortiGuard-Antispam, FortiGuard-Antivirus,
FortiGuard-Intrusion, FortiGuard-Web, FortiLog, FortiManager, Fortinet,
FortiOS, FortiPartner, FortiProtect, FortiReporter, FortiResponse,
FortiShield, FortiVoIP, and FortiWiFi are trademarks of Fortinet, Inc. in the
United States and/or other countries. The names of actual companies and
products mentioned herein may be the trademarks of their respective
owners.

Table of Contents
FortiGate User Authentication Version 1 Guide
01-28007-0233-20050825 3
Table of Contents
Introduction ........................................................................................ 5
The user’s view of authentication.................................................................... 5
Web-based user authentication .................................................................... 5
VPN client-based authentication ................................................................... 6
The FortiGate administrator’s view of authentication.................................... 6
Authentication servers................................................................................... 7
Users............................................................................................................. 7
User groups................................................................................................... 7
Authentication timeout................................................................................... 8
Firewall policies............................................................................................. 8
VPN tunnels .................................................................................................. 8
Authentication servers ...................................................................... 9
RADIUS Servers................................................................................................. 9
Understanding your RADIUS server ............................................................. 9
Configuring the FortiGate unit to use a RADIUS server................................ 9
LDAP Servers................................................................................................... 10
Understanding your LDAP server ............................................................... 11
Configuring the FortiGate unit to use an LDAP server................................ 12
Active Directory servers ................................................................................. 13
Understanding your Active Directory server................................................ 13
Configuring the FortiGate unit to use an Active Directory server ................ 13
Users and user groups.................................................................... 15
Users................................................................................................................. 15
Defining local users..................................................................................... 15
User groups...................................................................................................... 17
Protection profiles ....................................................................................... 17
Defining user groups ................................................................................... 17
Configuring authenticated access ................................................. 19
Authentication timeout.................................................................................... 19
Firewall policy authentication ........................................................................ 19
Configuring authentication for a firewall policy............................................ 20
Configuring authenticated access to the Internet........................................ 20
Firewall policy order .................................................................................... 21
VPN authentication.......................................................................................... 21
Authenticating PPTP and L2TP VPN users ................................................ 22
Authenticating remote IPSec VPN users using dialup groups .................... 23
Enabling XAuth authentication for dialup IPSec VPN clients ...................... 24

FortiGate User Authentication Version 1 Guide
401-28007-0233-20050825
Table of Contents

Introduction The user’s view of authentication
FortiGate User Authentication Version 1 Guide
01-28007-0233-20050825 5
Introduction
On a FortiGate unit, you can control access to network resources by defining lists
of authorized users, called user groups. To use a particular resource, such as a
network or a VPN tunnel, the user must belong to one of the user groups that is
allowed access. The user then must correctly enter a user name and password to
prove his or her identity. This is called authentication.
You can configure authentication for:
• any firewall policy with Action set to ACCEPT
• PPTP and L2TP VPNs
• a dialup IPSec VPN set up as an XAUTH server (Phase 1)
• a dialup IPSec VPN that accepts user group authentication as a peer ID
This document does not describe certificate-based VPN authentication. For
information about this type of authentication, see the FortiGate VPN Guide.
The user’s view of authentication
The user sees a request for authentication when trying to access the protected
resource. The way in which the request is presented to the user depends on the
method of access to that resource.
VPN authentication usually controls remote access to a private network
Web-based user authentication
Firewall policies usually control browsing access to an external network that
provides connection to the Internet. In this case, the FortiGate unit requests
authentication through the web browser:
The user types a user name and password and then selects OK. If the credentials
are incorrect, the FortiGate unit redisplays the authentication screen with blank
fields so that the user can try again. When the user enters valid credentials, the
FortiGate unit provides a success message:
At this point, the user selects OK and then can access the required resource. The
user gains access for the duration of the authentication timeout that the FortiGate
administrator configures. When this time period expires, the user must
authenticate again.

FortiGate User Authentication Version 1 Guide
601-28007-0233-20050825
The FortiGate administrator’s view of authentication Introduction
VPN client-based authentication
VPNs provide remote clients with access to a private network for a variety of
services: web browsing, email, file shares and so on. A client program such as
FortiClient negotiates the connection to the VPN and manages the user
authentication challenge from the FortiGate unit.
FortiClient can store the user name and password for a VPN as part of the
configuration for the VPN connection and pass them to the FortiGate unit as
needed. Or, FortiClient can request the user name and password from the user
when the FortiGate unit requests them.
User access expires after a period of inactivity, the authentication timeout, that the
administrator configures. The default is five minutes. The user must then
authenticate again.
The FortiGate administrator’s view of authentication
Authentication is based on user groups. You configure authentication parameters
for firewall policies and VPN tunnels to permit access only to members of
particular user groups. A member of a user group can be:
• a user whose user name and password are stored on the FortiGate unit
• a user whose name is stored on the Fortigate unit and whose password is
stored on an external authentication server
• an external authentication server with a database that contains the user name
and password of each person who is permitted access
You need to set up authentication in the following order:
1If external authentication is needed, configure the required servers.
•See“Configuring the FortiGate unit to use a RADIUS server” on page 9.
•See“Configuring the FortiGate unit to use an LDAP server” on page 12.
•See“Configuring the FortiGate unit to use an Active Directory server” on
page 13.
2Configure local user identities. For each user, you can choose whether the
FortiGate unit or an external authentication server verifies the password.
•See“Defining local users” on page 15.
3Create user groups.
Add local users to each user group as appropriate. You can also add an
authentication server to a user group. In this case, all users in the server’s
database can authenticate.
•See“Defining user groups” on page 17.
4Configure firewall policies and VPN tunnels that require authenticated access.
See “Configuring authentication for a firewall policy” on page 20.
See “Authenticating PPTP and L2TP VPN users” on page 22.
See “Authenticating remote IPSec VPN users using dialup groups” on page 23.
Note: In firmware releases prior to version 2.80 MR6, the authentication timeout period is
elapsed time, not inactive time.

Introduction The FortiGate administrator’s view of authentication
FortiGate User Authentication Version 1 Guide
01-28007-0233-20050825 7
See “Enabling XAuth authentication for dialup IPSec VPN clients” on page 24.
Authentication servers
The FortiGate unit can store user names and passwords and use them to
authenticate users. In an enterprise environment, it might be more convenient to
use the same system that provides authentication for local area network access,
email and other services. Users who access the corporate network from home or
while traveling could use the same user name and password that they use at the
office.
You can configure the FortiGate unit to work with external authentication servers
in two different ways:
• Add the authentication server to a user group.
Anyone in the server’s database is a member of the user group. This is a
simple way to provide access to the corporate VPN for all employees, for
example. You do not need to configure individual users on the FortiGate unit.
or
• Specify the authentication server instead of a password when you configure
the individual user identity on the FortiGate unit.
The user name must exist on both the FortiGate unit and authentication server.
User names that exist only on the authentication server cannot authenticate on
the FortiGate unit. This method enables you to provide access only to selected
employees, for example.
You cannot combine these two uses of an authentication server in the same user
group. If you add the server to the user group, adding individual users with
authentication to that server is redundant.
If you want to use external authentication servers, you must configure them before
you configure users and user groups.
Users
You define user identities in the User > Local page of the web-based manager.
Although it is simpler to define passwords locally, when there are many users the
administrative effort to maintain the database is considerable. Users cannot
change their own passwords on the FortiGate unit. When an external
authentication server is part of an enterprise network authentication system, users
can change their own passwords. Frequent changing of passwords is a good
security practice.
User groups
A user group can contain individual users and authentication servers. A user or
authentication server can belong to more than one group.
Authentication is group based. Firewall policies can allow multiple groups access,
but authentication for a VPN allows access to only one group. These
considerations affect how you define the groups for your organization. Usually you
need a user group for each VPN. For firewall policies, you can create user groups
that reflect how you manage network privileges in your organization. For example,
you might create a user group for each department or create user groups based
on functions such as customer support or account manager.

FortiGate User Authentication Version 1 Guide
801-28007-0233-20050825
The FortiGate administrator’s view of authentication Introduction
You select a protection profile for each User Group. Protection profiles determine
the level of web filtering, antivirus protection and spam filtering applied to traffic
controlled by the firewall policy to which members of this user group authenticate.
For more information about protection profiles, see the FortiGate Administration
Guide.
Authentication timeout
An authenticated connection expires when it has been idle for a length of time that
you specify. There is a single authentication timeout value that applies to every
case. The choice of timeout duration is a balance between security and user
convenience. The default is five minutes. For information about setting the
authentication timeout, see “Authentication timeout” on page 19.
Firewall policies
Access control is defined in the firewall policy that provides access to the network
resource. For example, access to the Internet through the external interface from
workstations on the internal network is made possible by an Internal to External
firewall policy.
Firewall policies apply web filtering, antivirus protection and spam filtering to the
traffic they control according a protection profile. When a firewall policy requires
authentication, its own protection profile option is disabled and the user group’s
protection profile applies.
For more information about firewall policies and protection profiles, see the
Firewall chapter of the FortiGate Administration Guide.
VPN tunnels
When you configure a PPTP or L2TP VPN, you choose one user group to be
permitted access. For IPSec VPNs, you can use authentication by user group or
XAUTH authentication using an external authentication server as an alternative to
authentication by peer ID.
For more information about VPNs, see the FortiGate VPN Guide.
Note: In firmware releases prior to version 2.80 MR6, the authentication timeout period
is elapsed time, not inactive time.

Authentication servers RADIUS Servers
FortiGate User Authentication Version 1 Guide
01-28007-0233-20050825 9
Authentication servers
FortiGate units support the following external authentication servers:
•RADIUS
•LDAP
• Microsoft Active Directory
If you are going to use authentication servers, you must configure the servers
before you configure FortiGate users or user groups that require them. An
authentication server can provide password checking for selected FortiGate users
or it can be added as a member of a FortiGate user group.
RADIUS Servers
Remote Authentication and Dial-in User Service (RADIUS) servers provide
authentication, authorization and accounting functions. FortiGate units use the
authentication function of the RADIUS server.
Understanding your RADIUS server
Your RADIUS server listens on either port 1812 or port 1645 for authentication
requests. You must configure it to accept the FortiGate unit as a client.
The RADIUS server user database can be any combination of:
• user names and passwords defined in a configuration file
• an SQL database
• the user account names and passwords configured on the computer where the
RADIUS server is installed
The RADIUS server uses a “shared secret” key to encrypt information passed
between it and clients such as the FortiGate unit.
See the documentation provided with your RADIUS server for configuration
details.
Configuring the FortiGate unit to use a RADIUS server
On the FortiGate unit, the default port for RADIUS traffic is 1812. If your RADIUS
server is using port 1645, you can either
• Reconfigure the RADIUS server to use port 1812. See your RADIUS server
documentation for more information.
or
• Change the FortiGate unit default RADIUS port to 1645 using the the CLI:
config system global
set radius_port 1645
end

FortiGate User Authentication Version 1 Guide
10 01-28007-0233-20050825
LDAP Servers Authentication servers
To configure the FortiGate unit, you need to know the server’s domain name or IP
address and its shared secret key.
To configure the FortiGate unit for RADIUS authentication - web-based
manager
1Go to User > RADIUS.
2Select Create New to add a new RADIUS server or select the Edit icon to edit an
existing configuration.
3Enter the Name of the RADIUS server.
4Enter the domain name or IP address of the RADIUS server.
5Enter the RADIUS server secret.
6Select OK.
To configure the FortiGate unit for RADIUS authentication - CLI
config user radius
edit <name>
set secret <password>
set server <ip_address>
end
To remove a RADIUS server from the FortiGate unit configuration
You cannot remove a RADIUS server that belongs to a user group. Remove it
from the user group first.
1Go to User > RADIUS.
2Select the Delete icon beside the RADIUS server name that you want to remove.
3Select OK.
To remove a RADIUS server from the FortiGate unit configuration - CLI
config user radius
delete <name>
end
LDAP Servers
Lightweight Directory Access Protocol (LDAP) is an Internet protocol used to
maintain databases of user names, passwords, email addresses and other
information.
The scale of LDAP servers ranges from big public servers such as BigFoot and
Infospace to large organizational servers at universities and corporations to small
LDAP servers for workgroups. This document focuses on the institutional and
workgroup applications of LDAP.
The FortiGate unit supports LDAP protocol functionality as defined in RFC 2251
for looking up and validating user names and passwords. FortiGate LDAP
supports all LDAP servers compliant with LDAP v3.

Authentication servers LDAP Servers
FortiGate User Authentication Version 1 Guide
01-28007-0233-20050825 11
FortiGate LDAP does not support proprietary functionality, such as notification of
password expiration, which is available from some LDAP servers. FortiGate LDAP
does not supply information to the user about why authentication failed.
Understanding your LDAP server
To configure your FortiGate unit to work with an LDAP server, you need to
understand the organization of the information on the server.
The top of the hierarchy is the organization itself. Usually this is defined as
Domain Component (DC), a DNS domain. If the name contains a dot, such as
“example.com”, it is written as two parts: “dc=example,dc=com”.
In this example, Common Name (CN) identifiers reside at the Organization Unit
(OU) level, just above DC. The Distinguished Name (DN) is
ou=People,dc=example,dc=com.
In addition to the DN, the FortiGate unit needs an identifier for the individual
person. Although the FortiGate unit GUI calls this the Common Name (CN), the
identifier you use is not necessarily CN. On some servers, CN is the full name of a
person. It might be more convenient to use the same identifier used on the local
computer network. In this example, User ID (UID) is used.
You need to determine the levels of the hierarchy from the top to the level that
contains the identifier you want to use. This defines the DN that the FortiGate unit
uses to search the LDAP database. Frequently used distinguished name
elements include:
• pw (password)
• cn (common name)
• ou (organizational unit)
• o (organization)
• c (country)
One way to test this is with a text-based LDAP client program. For example,
OpenLDAP includes a client, ldapsearch, that you can use for this purpose.
Enter the following command:
ldapsearch -x '(objectclass=*)'

FortiGate User Authentication Version 1 Guide
12 01-28007-0233-20050825
LDAP Servers Authentication servers
The output is lengthy, but the information you need is in the first few lines:
version: 2
#
# filter: (objectclass=*)
# requesting: ALL
#
dn: dc=example,dc=com
dc: example
objectClass: top
objectClass: domain
dn: ou=People,dc=example,dc=com
ou: People
objectClass: top
objectClass: organizationalUnit
...
dn: uid=auser,ou=People,dc=example,dc=com
uid: auser
cn: Alex User
Configuring the FortiGate unit to use an LDAP server
After you determine the common name and distinguished name identifiers and the
domain name or IP address of the LDAP server, you can configure the server on
the FortiGate unit.
To configure the FortiGate unit for LDAP authentication - web-based
manager
1Go to User > LDAP.
2Select Create New to add a new LDAP server, or select the Edit icon to edit an
existing configuration.
3Enter a name for the LDAP server.
4Enter the domain name or IP address of the LDAP server.
5Enter the port used to communicate with the LDAP server.
6Enter the common name identifier for the LDAP server.
7Enter the distinguished name used to look up entries on the LDAP server.
8Select OK.
To configure the FortiGate unit for LDAP authentication - CLI
config user ldap
edit <name>
set cnid <common_name_identifier>
set dn <distinguished_name>
set server <ip_address>
end

Authentication servers Active Directory servers
FortiGate User Authentication Version 1 Guide
01-28007-0233-20050825 13
To remove an LDAP server from the FortiGate unit configuration
You cannot remove an LDAP server that belongs to a user group. Remove it from
the user group first.
1Go to User > LDAP.
2Select Delete beside the LDAP server name that you want to remove.
3Select OK.
To remove an LDAP server from the FortiGate unit configuration - CLI
config user ldap
delete <name>
end
Active Directory servers
Active Directory server stores information about network objects, such as users,
systems and services, on Microsoft Windows networks. It first became available in
Windows 2000 Server.
Understanding your Active Directory server
Active Directory server organizes information hierarchically, similar to an LDAP
server. Although it accepts LDAP queries, the Active Directory server native form
of query is simpler. It does not require a common name identifier or a
distinguished name. For each object there is a shortcut to the distinguished name
called the User Principal Name (UPN). The UPN looks similar to an email
address. It consists of a short name like a user ID, followed by an “@” symbol,
followed by the server domain name: [e-mail], for example. The
user enters this as the user name at the authentication prompt.
Configuring the FortiGate unit to use an Active Directory server
You can configure the FortiGate unit to access the Active Directory server using
either distinguished name or UPN.
To configure the FortiGate unit for Active Directory server authentication
1Go to User > LDAP.
2Select Create New to add a new LDAP server, or select the Edit icon to edit an
existing configuration.
3Enter a name for the Active Directory server.
4Enter the domain name or IP address of the Active Directory server.
5Enter the port used to communicate with the Active Directory server.
6Enter the common name identifier. If you want users to authenticate by UPN,
leave this field blank.
7Enter the distinguished name used to look up entries on the server. If you want
users to authenticate by UPN, leave this field blank.
8Select OK.

FortiGate User Authentication Version 1 Guide
14 01-28007-0233-20050825
Active Directory servers Authentication servers
To configure Active Directory server authentication using LDAP queries -
CLI
config user ldap
edit <name>
set cnid <common_name_identifier>
set dn <distinguished_name>
set server <ip_address>
end
To configure Active Directory server authentication using UPN queries - CLI
config user ldap
edit <name>
set server <ip_address>
end
To remove an Active Directory server from the FortiGate unit configuration
You cannot remove an Active Directory server that has been added to a user
group. Remove it from the user group first.
1Go to User > LDAP.
2Select Delete beside the server name that you want to delete.
3Select OK.
To remove an Active Directory server from the FortiGate unit configuration -
CLI
config user ldap
delete <name>
end

Users and user groups Users
FortiGate User Authentication Version 1 Guide
01-28007-0233-20050825 15
Users and user groups
Authentication is based on user groups. First you configure users, then you create
user groups and add users to them.
Users
A user is a user account configured on the FortiGate unit and/or on an external
authentication server. Users can access resources that require authentication
only if they are members of an allowed user group.
This section describes how to configure local users. For information about
configuration of authentication servers see “Authentication servers” on page 9.
Defining local users
To define a local user you need:
• a user name
• a password or the name of an authentication server that has been configured
on the FortiGate unit
If the user is authenticated externally, the user name on the FortiGate unit must be
identical to the user name on the authentication server.
Table 1: How the FortiGate unit authenticates different types of users
User type Authentication
Local user with password
stored on the FortiGate unit The user name and password must match a user account stored on the FortiGate unit.
Local user with password
stored on an authentication
server
The user name must match a user account stored on the
FortiGate unit and the user name and password must match a
user account stored on the authentication server associated
with that user.
Authentication server user Any user with an identity on the authentication server can
authenticate on the FortiGate unit by providing a user name
and password that match a user identity stored on the
authentication server.

FortiGate User Authentication Version 1 Guide
16 01-28007-0233-20050825
Users Users and user groups
To define a local user - web-based manager
1Go to User > Local.
2Select Create New.
3Enter the user name.
4Do one of the following:
• To authenticate this user locally, select Password and type a password.
• To authenticate this user using an LDAP or Active Directory server, select
LDAP and select the server name.
• To authenticate this user using a RADIUS server, select RADIUS and select
the server name.
If you want to use an authentication server, you must configure access to it first.
See “Authentication servers” on page 9.
5Select OK.
To define a local user - CLI
config user local
edit <user_name>
set type password
set passwd <user_password>
end
or
config user local
edit <user_name>
set type ldap
set ldap_server <server_name>
end
or
config user local
edit <user_name>
set type radius
set radius_server <server_name>
end

Users and user groups User groups
FortiGate User Authentication Version 1 Guide
01-28007-0233-20050825 17
User groups
User groups have users or authentication servers as members. Firewall policies
and some types of VPN configurations allow access to user groups, not to
individual users.
Protection profiles
Each user group is associated with a protection profile to determine the antivirus,
web filtering, spam filtering, and intrusion protection settings that apply to the
authenticated connection. The FortiGate unit contains several pre-configured
protection profiles and you can create your own as needed.
When you create or modify any firewall policy, you can select a protection profile.
But when a firewall policy requires authentication, its own protection profile is
disabled and the user group protection profile applies. For more information about
protection profiles, see “Protection profile” in the Firewall chapter of the FortiGate
Administration Guide for your unit.
Protection profiles do not apply to VPN connections.
Defining user groups
You define a user group by typing a name, selecting users and/or authentication
servers and selecting a protection profile.
To define a group - web-based manager
1Go to User > User Group.
2Select Create New.
3Enter a name for the user group.
4One at a time, select user names from the Available Users list and select the right-
pointing arrow to move them to the Members List.
In the lists, users defined in User > Local are listed under Local Users and
authentication servers are listed under Users on RADIUS/LDAP servers.
5If you are using this user group for firewall policy authentication, select a
protection profile.
6Select OK.

FortiGate User Authentication Version 1 Guide
18 01-28007-0233-20050825
User groups Users and user groups
To define a group - CLI
config user group
edit <group_name>
set member <user1> <user2> ... <usern>
set profile <profile_name>
end

Configuring authenticated access Authentication timeout
FortiGate User Authentication Version 1 Guide
01-28007-0233-20050825 19
Configuring authenticated access
When you have configured authentication servers, users and user groups, you
are ready to configure firewall policies and certain types of VPNs to require user
authentication.
This chapter describes:
• how to set the authentication timeout for all authenticated connections
• how to configure authentication in firewall policies
• how to configure authentication for PPTP and L2TP VPNs and certain
configurations of IPSec VPNs
Authentication timeout
Set the firewall user authentication timeout (Auth Timeout) to control how long an
authenticated connection can be idle before the user must authenticate again.
The maximum timeout is 480 minutes (8 hours). The default timeout is 15
minutes.
To set the authentication timeout
1Go to System > Config > Options.
2Enter the Auth Timeout value (minutes).
3Select Apply.
Firewall policy authentication
Firewall policies control traffic between FortiGate interfaces, both physical
interfaces and VLAN subinterfaces. Without authentication, a firewall policy
enables access from one network to another for all users on the source network.
Authentication enables you to allow access only for users who are members of
selected user groups.
You can configure user authentication only for firewall policies where the Action is
Accept.

FortiGate User Authentication Version 1 Guide
20 01-28007-0233-20050825
Firewall policy authentication Configuring authenticated access
Configuring authentication for a firewall policy
Authentication is an Advanced firewall option.
To configure authentication for a firewall policy
1Create users and one or more user groups.
For more information, see “Users and user groups” on page 15.
2Go to Firewall > Policy.
3Select Create New and create a new policy or select Edit on an existing policy.
4From the Action list, select ACCEPT.
5Configure the other firewall policy parameters as appropriate.
For information about firewall policies, see the Firewall chapter of the FortiGate
Administration Guide.
6Select Advanced.
7Select Authentication.
8One at a time, select user group names from the Available Groups list and select
the right-pointing arrow button to move them to the Allowed list. All members of
the groups in the Allowed list will be authenticated to use the firewall policy.
9Select OK.
Configuring authenticated access to the Internet
A policy for accessing the Internet is similar to a policy for accessing a specific
network, but the destination address is set to all. The destination interface is the
one that connects to the Internet service provider. For general purpose Internet
access, the Service is set to ANY.
Access to HTTP, HTTPS, FTP and Telnet sites may require access to a domain
name service. DNS requests do not trigger authentication. You must configure a
policy to permit unauthenticated access to the appropriate DNS server, and this
policy must precede the policy for Internet access.
To configure a firewall policy for access to a DNS server
1Go to Firewall > Policy.
2Select Create New.
3From the Source Interface/Zone list, select the interface to which computers on
your network are connected.
4From the Destination Interface/Zone list, select the interface that connects to the
Internet.