Fortinet FortiGate v3.0 MR7 User manual

www.fortinet.com

FortiOS v3.0 MR7

User Authentication User Guide

USER GUIDE

FortiOS v3.0 MR7 User Authentication User Guide

28 Aug 2008

01-30007-0347-20080828

publication including text, examples, diagrams or illustrations may be

reproduced, transmitted, or translated in any form or by any means,

electronic, mechanical, manual, optical or otherwise, for any purpose,

without prior written permission of Fortinet, Inc.

Trademarks

Fortinet, FortiGate and FortiGuard are registered trademarks and

Dynamic Threat Prevention System (DTPS), APSecure, FortiASIC,

FortiBIOS, FortiBridge, FortiClient, FortiDB, FortiGate, FortiGate Unified

Threat Management System, FortiGuard-Antispam, FortiGuard-Antivirus,

FortiGuard-Intrusion, FortiGuard-Web, FortiLog, FortiAnalyzer,

FortiManager, FortiOS, FortiPartner, FortiProtect, FortiReporter,

FortiResponse, FortiShield, and FortiVoIP, are trademarks of Fortinet, Inc.

in the United States and/or other countries. The names of actual

companies and products mentioned herein may be the trademarks of

their respective owners.

Contents

FortiOS v3.0 MR7 User Authentication User Guide

01-30007-0347-20080828 3

Contents

Introduction........................................................................................ 5

About authentication......................................................................................... 5

User’s view of authentication........................................................................... 6

Web-based user authentication .................................................................... 6

VPN client-based authentication................................................................... 6

FortiGate administrator’s view of authentication........................................... 7

Authentication servers................................................................................... 8

Public Key Infrastructure (PKI) authentication .............................................. 9

Peers............................................................................................................. 9

Users............................................................................................................. 9

User groups................................................................................................... 9

Authentication timeout................................................................................. 10

Firewall policies........................................................................................... 10

VPN tunnels................................................................................................ 10

About this document....................................................................................... 10

Document conventions................................................................................ 10

Typographic conventions...................................................................... 11

FortiGate documentation................................................................................ 11

Related documentation................................................................................... 12

FortiManager documentation...................................................................... 13

FortiClient documentation ........................................................................... 13

FortiMail documentation.............................................................................. 13

FortiAnalyzer documentation ...................................................................... 13

Fortinet Tools and Documentation CD........................................................ 14

Fortinet Knowledge Center ........................................................................ 14

Comments on Fortinet technical documentation ........................................ 14

Customer service and technical support...................................................... 14

FortiGate authentication servers.................................................... 15

RADIUS servers............................................................................................... 15

Configuring the FortiGate unit to use a RADIUS server.............................. 16

LDAP servers................................................................................................... 19

Configuring the FortiGate unit to use an LDAP server................................ 21

Using the Query icon............................................................................ 24

TACACS+ servers............................................................................................ 24

Configuring the FortiGate unit to use a TACACS+ authentication server... 25

Directory Service servers ............................................................................... 26

Configuring the FortiGate unit to use a Directory Service server................ 28

FortiOS v3.0 MR7 User Authentication User Guide

401-30007-0347-20080828

Contents

Users/peers and user groups......................................................... 31

Users/peers...................................................................................................... 31

Creating local users .................................................................................... 32

Creating peer users .................................................................................... 34

User groups ..................................................................................................... 37

Firewall user groups.................................................................................... 37

Directory Service user groups..................................................................... 37

SSL VPN user groups................................................................................. 38

Protection profiles ....................................................................................... 38

Configuring user groups.............................................................................. 39

Configuring Directory Service user groups........................................... 40

Configuring SSL VPN user groups....................................................... 41

Configuring Peer user groups............................................................... 42

Configuring authenticated access ................................................. 43

Authentication timeout ................................................................................... 43

Authentication protocols................................................................................ 43

Firewall policy authentication........................................................................ 44

Configuring authentication for a firewall policy............................................ 45

Firewall policy order.................................................................................... 46

Configuring authenticated access to the Internet........................................ 47

VPN authentication.......................................................................................... 48

Configuring authentication of SSL VPN users ............................................ 48

Configuring strong authentication of SSL VPN users/user groups ............. 50

Configuring authentication of VPN peers and clients.................................. 51

Configuring authentication of PPTP VPN users/user groups............... 51

Configuring authentication of L2TP VPN users/user groups................ 52

Configuring authentication of remote IPSec VPN users....................... 52

Configuring XAuth authentication......................................................... 54

Index.................................................................................................. 57

Introduction About authentication

FortiOS v3.0 MR7 User Authentication User Guide

01-30007-0347-20080828 5

Introduction

This section introduces you to the authentication process from the user and the

administrators perspective, and provides supplementary information about

Fortinet publications.

The following topics are covered in this section:

•About authentication

•User’s view of authentication

•FortiGate administrator’s view of authentication

•About this document

•FortiGate documentation

•Related documentation

•Customer service and technical support

About authentication

Computer networks have, for the most part, improved worker efficiency and

helped a company’s bottom line. Along with these benefits, the need has arisen

for workers to be able to remotely access their corporate network, with

appropriate security measures in place. In general terms, authentication is the

process of attempting to verify the (digital) identity of the sender of a

communication such as a log in request. The sender may be someone using a

computer, the computer itself, or a computer program. A computer system should

only be used by those who are authorized to do so, therefore there must be a

measure in place to detect and exclude any unauthorized access.

On a FortiGate unit, you can control access to network resources by defining lists

of authorized users, called user groups. To use a particular resource, such as a

network or a VPN tunnel, the user must:

• belong to one of the user groups that is allowed access

• correctly enter a user name and password to prove his or her identity, if asked

to do so

This process is called authentication.

You can configure authentication for:

• any firewall policy with Action set to ACCEPT

• SSL VPNs

• PPTP and L2TP VPNs

• a dialup IPSec VPN set up as an XAUTH server (Phase 1)

• a dialup IPSec VPN that accepts user group authentication as a peer ID

Note: This document does not describe certificate-based VPN authentication. For

information about this type of authentication, see the FortiGate IPSec VPN Guide and the

FortiGate Certificate Management User Guide.

FortiOS v3.0 MR7 User Authentication User Guide

601-30007-0347-20080828

User’s view of authentication Introduction

User’s view of authentication

The user sees a request for authentication when they try to access a protected

resource. The way in which the request is presented to the user depends on the

method of access to that resource.

VPN authentication usually controls remote access to a private network.

Web-based user authentication

Firewall policies usually control browsing access to an external network that

provides connection to the Internet. In this case, the FortiGate unit requests

authentication through the web browser:

The user types a user name and password and then selects Continue/Login. If the

credentials are incorrect, the authentication screen is redisplayed with blank fields

so that the user can try again. When the user enters valid credentials, they get

access to the required resource. In some cases, if a user tries to authenticate

several times without success, a message appears, such as: “Too many bad login

attempts. Please try again in a few minutes.”

VPN client-based authentication

VPNs provide remote clients with access to a private network for a variety of

services that include web browsing, email, and file sharing. A client program such

as FortiClient negotiates the connection to the VPN and manages the user

authentication challenge from the FortiGate unit.

Note: After a defined period of user inactivity (the authentication timeout, defined

by the FortiGate administrator), the user access will expire. The default is 5

minutes. To access the resource, the user will have to authenticate again.

Introduction FortiGate administrator’s view of authentication

FortiOS v3.0 MR7 User Authentication User Guide

01-30007-0347-20080828 7

FortiClient can store the user name and password for a VPN as part of the

configuration for the VPN connection and pass them to the FortiGate unit as

needed. Or, FortiClient can request the user name and password from the user

when the FortiGate unit requests them.

SSL VPN is a form of VPN that can be used with a standard Web browser. There

are two modes of SSL VPN operation (supported in NAT/Route mode only):

• web-only mode, for thin remote clients equipped with a web-browser only

• tunnel mode, for remote computers that run a variety of client and server

applications.

FortiGate administrator’s view of authentication

Authentication is based on user groups. You configure authentication parameters

for firewall policies and VPN tunnels to permit access only to members of

particular user groups. A member of a user group can be:

• a user whose user name and password are stored on the FortiGate unit

• a user whose name is stored on the FortiGate unit and whose password is

stored on a remote or external authentication server

• a remote or external authentication server with a database that contains the

user name and password of each person who is permitted access

1If remote or external authentication is needed, configure the required servers.

•See“Configuring the FortiGate unit to use a RADIUS server” on page 16.

•See“Configuring the FortiGate unit to use an LDAP server” on page 21.

•See“Configuring the FortiGate unit to use a Directory Service server” on

page 28.

2Configure local and peer (PKI) user identities (see “Public Key Infrastructure (PKI)

authentication” on page 9). For each local user, you can choose whether the

FortiGate unit or a remote authentication server verifies the password. Peer

members can be included in user groups for use in firewall policies.

•See“Creating local users” on page 34.

•See“Creating peer users” on page 36.

Note: After a defined period of user inactivity on the VPN connection (the idle

timeout, defined by the FortiGate administrator), the user access will expire. The

default is 1500 seconds (25 minutes). To access the resource, the user will have

to authenticate again.

FortiOS v3.0 MR7 User Authentication User Guide

801-30007-0347-20080828

FortiGate administrator’s view of authentication Introduction

3Create user groups.

Add local/peer user members to each user group as appropriate. You can also

add an authentication server to a user group. In this case, all users in the server’s

database can authenticate. You can only configure peer user groups through the

CLI.

•See“Configuring user groups” on page 41.

4Configure firewall policies and VPN tunnels that require authenticated access.

See “Configuring authentication for a firewall policy” on page 49.

See “Configuring authentication of PPTP VPN users/user groups” on page 55.

See “Configuring authentication of remote IPSec VPN users” on page 56.

See “Configuring XAuth authentication” on page 58.

Authentication servers

The FortiGate unit can store user names and passwords and use them to

authenticate users. In an enterprise environment, it might be more convenient to

use the same system that provides authentication for local area network access,

email and other services. Users who access the corporate network from home or

while traveling could use the same user name and password that they use at the

office.

You can configure the FortiGate unit to work with remote or external authentication

servers in two different ways:

• Add the authentication server to a user group.

Anyone in the server’s database is a member of the user group. This is a

simple way to provide access to the corporate VPN for all employees, for

example. You do not need to configure individual users on the FortiGate unit.

• Specify the authentication server instead of a password when you configure

the individual user identity on the FortiGate unit.

The user name must exist on both the FortiGate unit and authentication server.

User names that exist only on the authentication server cannot authenticate on

the FortiGate unit. This method enables you to provide access only to selected

employees, for example.

If you want to use remote or external authentication servers, you must configure

them before you configure users and user groups. See “RADIUS servers” on

page 15, “LDAP servers” on page 19, “TACACS+ servers” on page 25, and

“Directory Service servers” on page 27.

Note: You cannot combine these two uses of an authentication server in the same user

group. If you add the server to the user group, adding individual users with authentication to

that server is redundant.

Introduction FortiGate administrator’s view of authentication

FortiOS v3.0 MR7 User Authentication User Guide

01-30007-0347-20080828 9

Public Key Infrastructure (PKI) authentication

A Public Key Infrastructure (PKI) is a comprehensive system of policies,

processes, and technologies working together to enable users of the Internet to

exchange information in a secure and confidential manner. PKIs are based on the

use of cryptography - the scrambling of information by a mathematical formula

and a virtual key so that it can only be decoded by an authorized party using a

related key. The public and private cryptographic key pair is obtained and shared

through a trusted authority. The public key infrastructure enables the creation of a

digital certificate that can identify an individual or organization, and directory

services that can store and also revoke the certificates.

Public Key Infrastructure (PKI) authentication utilizes a certificate authentication

library that takes a list of ‘peers’, ‘peer’ groups, and/or user groups and returns

authentication ‘successful’ or ‘denied’ notifications. Users only need a valid

certificate for successful authentication - no username or password are

necessary.

Peers

A peer is a user that is a digital certificate holder used in PKI authentication. To

use PKI authentication, you must define peers to include in the authentication

user group. See “Users/peers” on page 33.

Users

Although it is simpler to define passwords locally, when there are many users the

administrative effort to maintain the database is considerable. Users cannot

change their own passwords on the FortiGate unit. When a remote or external

remote authentication server is part of an enterprise network authentication

system, users can change their own passwords. See “Users/peers” on page 33.

User groups

A user group can contain individual users/peers and authentication servers. A

user/peer or authentication server can belong to more than one group.

Authentication is group-based. Firewall policies can allow multiple groups access,

but authentication for a VPN allows access to only one group. These

considerations affect how you define the groups for your organization. Usually you

need a user group for each VPN. For firewall policies, you can create user groups

that reflect how you manage network privileges in your organization. For example,

you might create a user group for each department or create user groups based

on functions such as customer support or account management.

You select a protection profile for each user group. Protection profiles determine

the level of web filtering, antivirus protection, and spam filtering applied to traffic

controlled by the firewall policy to which members of this user group authenticate.

For more information about protection profiles, see the FortiGate Administration

Guide.

Note: Frequent changing of passwords is a good security practice.

FortiOS v3.0 MR7 User Authentication User Guide

10 01-30007-0347-20080828

About this document Introduction

Authentication timeout

An authenticated connection expires when it has been idle for a length of time that

you specify. The authentication timeout value set in User > Authentication >

Authentication applies to every user of the system. The choice of timeout

duration is a balance between security and user convenience. The default is

5 minutes. For information about setting the authentication timeout, see

“Authentication timeout” on page 47.

Firewall policies

Access control is defined in the firewall policy that provides access to the network

resource. For example, access to the Internet through the external interface from

workstations on the internal network is made possible by an Internal to External

firewall policy.

Firewall policies apply web filtering, antivirus protection, and spam filtering to the

traffic they control according to a protection profile. If the firewall policy requires

authentication, the protection profile in the firewall policy is disabled. Instead, the

protection profile is configured in the authenticating user group.

For more information about firewall policies and protection profiles, see the

Firewall chapters of the FortiGate Administration Guide.

VPN tunnels

When you configure a PPTP or L2TP VPN, you choose one user group to be

permitted access. For IPSec VPNs, you can use authentication by user group or

XAUTH authentication using an external authentication server as an alternative to

authentication by peer ID. Access to SSL VPN applications is controlled through

user groups. When the remote client connects to the FortiGate unit, the FortiGate

unit authenticates the user based on user name, password, and authentication

domain. Authentication for a VPN allows access to only one group.

For more information about VPNs, see the FortiGate PPTP VPN User Guide,

FortiGate SSL VPN User Guide, or the FortiGate IPSec VPN User Guide.

About this document

This document explainshow to configure authentication for firewall policies, PPTP,

L2TP and SSL VPNs, and dialup IPSec VPNs, and contains the following

chapters:

•Authentication servers contains procedures for configuring RADIUS, LDAP,

and Microsoft Active Directory authentication servers.

•Users/peers and user groups contains procedures for defining users/peers and

user groups.

•Configuring authenticated access contains procedures to set authentication

timeouts, configure authentication in firewall policies, for PPTP, L2TP and SSL

VPNs, and certain configurations of IPSec VPNs.

Document conventions

The following document conventions are used in this guide:

Table of contents

Other Fortinet Gateway manuals

Fortinet

Fortinet FortiVoice FVG-GT01 User manual

Fortinet

Fortinet FortiGate-60M User manual

Fortinet

Fortinet FortiGate 4000 User manual

Fortinet

Fortinet FortiGate 60M User manual

Fortinet

Fortinet FortiGate-600C-DC User manual

Fortinet

Fortinet FortiVoice FXO Quick reference guide

Fortinet

Fortinet FortiGate 100 User manual

Fortinet

Fortinet FortiADC 60F User manual

Fortinet

Fortinet FortiSandbox 1000D User manual

Fortinet

Fortinet FortiSwitch 1048D User manual

Fortinet

Fortinet FortiVoice FVG-GT02 User manual

Fortinet

Fortinet FortiGate 620B User manual

Fortinet

Fortinet FortiGate 3140B User manual

Fortinet

Fortinet FortiGate 400 User manual

Fortinet

Fortinet FortiGate 30B User manual

Fortinet

Fortinet FortiVoice Gateway GT01 Quick reference guide

Fortinet

Fortinet FortiGate 310B User manual

Fortinet

Fortinet FortiGate-600C-LENC User manual

Fortinet

Fortinet FortiGate 110C User manual

Fortinet

Fortinet FortiVoice FVG-GO08 User manual

Fortinet

Fortinet FortiGate 60B User manual

Fortinet

Fortinet FortiGate 80C-LENC User manual

Fortinet

Fortinet FortiGate-200B-POE User manual

Fortinet

Fortinet FortiGate 3040B User manual

Popular Gateway manuals by other brands

LST

LST M500RFE-AS Specification sheet

Kinnex

Kinnex Media Gateway quick start guide

2N Telekomunikace

2N Telekomunikace 2N StarGate user manual

Mitsubishi Heavy Industries

Mitsubishi Heavy Industries Superlink SC-WBGW256 Original instructions

ZyXEL Communications

ZyXEL Communications ZYWALL2 ET 2WE user guide

Telsey

Telsey CPVA 500 - SIP Technical manual

RTA

RTA 460A-NNA4 Product user guide

Shaw

Shaw Gateway HDPVR user manual

ABB

ABB VSN900 Commissioning manual

Commander

Commander Pulse owner's manual

2N Telekomunikace

2N Telekomunikace ATEUS EasyGate 501309E manual

NETGEAR

NETGEAR C6300BD installation guide

Amit

Amit CDW531AM user guide

HMS

HMS Netbiter EasyConnect EC150 user manual

Huawei

Huawei EchoLife HG620 user guide

AT&T

AT&T U-verse 3801 Replacement self-installation guide

Logic IO

Logic IO RTCU MX2 turbo Technical manual

Suttle

Suttle MediaMAX MXM-521 installation instructions