Fortigate - BYOD Authentication

[FN-GM]

Hello,

 

I am wondering how you guys handle authentication for BYOD with Fortigate firewalls please? Looking online everything points to using Forinets own WIFI solution. This is something we do not use.

 

Thanks

[RLR]

Our students sign into the wifi (Aruba) with their AD credentials. We have a radius (NPS) server that links to fortigate. We also use SSL inspection so students are required to install a certificate to get filtering. We have a guide depending on the device they use so they can follow the instructions for installing the certificate (or we do it sometimes).

[FN-GM]

Our students sign into the wifi (Aruba) with their AD credentials. We have a radius (NPS) server that links to fortigate. We also use SSL inspection so students are required to install a certificate to get filtering. We have a guide depending on the device they use so they can follow the instructions for installing the certificate (or we do it sometimes).

 

How does the link to the Fortigate work please? Did you follow a guide please?

[RLR]

How does the link to the Fortigate work please? Did you follow a guide please?

 

I didn't set it up or manage it so can't go into much detail.

 

On NPS Windows Server:

- Add Radius clients (for us this is the master Aruba access point at each of our locations).

 

- Point Remote Radius server to for Fortigate.

 

- Setup a connection request policy (we use windows auth for all users)

 

- Setup Network Policies. Our network polices are specific ad groups of people to make sure they get the correct filtering (staff/specific year group of students/etc). These policies give you a Class attribute that you can then put into Fortigate as a unique identifier to create user groups (under User & Devices on Fortigate) using Radius Single Sign On.

 

Create wifi policies based on the user group you created.

 

This is a just a quick overview of what I'm currently seeing.