Azure AD, Fortinet Filtering

[Alawil]

Hi

 

We are a small primary with a fairly simple setup that currently consists of Windows 10 laptops, iPads, domain server, Fortigate firewall and FSSO. Currently when staff login to the laptops the FSSO agent on the DC tells the fortigate who is logged onto which machine and they pickup one web filtering policy which means they can get to Youtube for example. When children login they get a different filtering policy and cannot get to Youtube. From the shared iPads everybody gets the same filtering policy and cannot get to Youtube. This is all fine.

 

We want to move to entirely cloud removing the DC and moving to Azure AD, Intune, Configuration Manager etc.

 

There does not seem to be an FSSO agent that works with AzureAD.

 

Does anyone have any cleaver ideas on a cost effective way of having the same filtering group setup when the laptops are Azure AD joined?

[BroganOs]

I’m pretty sure there is a fortigate enterprise app in azure that could be what your looking for

[Alawil]

There is Fortiauthenticator, which in combination with the Fortinet SSO mobility agent would give the same FSSO but it comes at about £1000 for 100 users.

 

Another thought we had was 802.1x and putting teachers on a separate vlan with a different filtering profile, but there does not seem to be a simple way to connect the switches/Wi-Fi to AzureAD.

 

Any ideas welcomed.

[Reverend_Dan]

Anyone have any updates on this problem as we are facing similar issues. But after watching the ANME conference video i'm thinking 802.1x is probably the way to go for to be compliant with the DFE standards

[jslate1980]

It’s a shame solutions like cloudRadius are so expensive. Or that Microsoft could move things forward and create a more seamless solution for authentication with wireless systems.

[RLR]

Did anyone find an answer to this? I've got FortiAuthenticator working with the FSSO Mobility Agent as a Proof of Concept but I've been quote £5k+ which seems a bit much just to make sure our users are being filtered correctly.

 

This is for shared devices also so 802.1x won't work for this as there is no user assigned to the device (or is there another way?)

[jslate1980]

Did anyone find an answer to this? I've got FortiAuthenticator working with the FSSO Mobility Agent as a Proof of Concept but I've been quote £5k+ which seems a bit much just to make sure our users are being filtered correctly.

 

This is for shared devices also so 802.1x won't work for this as there is no user assigned to the device (or is there another way?)

 

I have been looking at testing this https://docs.fortinet.com/document/fortigate/7.0.14/administration-guide/33053/outbound-firewall-authentication-with-microsoft-entra-id-as-a-saml-idp.

Only concern is all traffic is then pointed to the portal page to authenticate, but talking to Fortinet they said you can separate firewall rules to deal with this.

[Mr_Jiminy]

We tested this last year, it uses SAML.

We only conducted preliminary testing and plan to pick it up again after the next half term.

[RLR]

I have been looking at testing this https://docs.fortinet.com/document/fortigate/7.0.14/administration-guide/33053/outbound-firewall-authentication-with-microsoft-entra-id-as-a-saml-idp.

Only concern is all traffic is then pointed to the portal page to authenticate, but talking to Fortinet they said you can separate firewall rules to deal with this.

 

I've just been working through this. Hopefully finish it tomorrow and see if it works. Im getting conflicted answers about whether or not the user has to login to a portal or if it does it automatically.

[jslate1980]

I've just been working through this. Hopefully finish it tomorrow and see if it works. Im getting conflicted answers about whether or not the user has to login to a portal or if it does it automatically.

 

Hopefully SSO will take place when directed to the page.

[RobFuller]

Have been trying to set this up with little success so far, just does appear to be signing in correctly. Would be interesting to hear from anyone who has this working.

[jslate1980]

Have been trying to set this up with little success so far, just does appear to be signing in correctly. Would be interesting to hear from anyone who has this working.

 

What has been the issues you have had with it so far? I am no where near implementation and I don’t want to touch it until spring bank holidays, as I have multiple colleges going through the firewall. Also may hold off as our firewalls and filtering is going out to tender soon.

[Alawil]

We were able to get it mostly running but did/do have a few issues:

 

1) We really struggled to get it working on FortiOS v7, we ended up sticking with the latest v6.4.xx - been running it for probably about a year now.

 

2) We had to use google.co.uk as the homepage to get the SSO work seamlessly, we tried Sharepoint and the school website but had real issues. Fortinet pointed us at https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/934626/captive-portals and https://www.chromium.org/chromium-os/chromiumos-design-docs/network-portal-detection/ and explained we had to use any website that supports 80/http to trigger the redirect for transparent/seamless SSO using the logged in user credentials.

 

3) We found that switching users or user log off did not force the authentication logout, rather if a teacher logged into a device then logged out, then a student logged in they would likely get the teacher permissions. In a nutshell, the firewall authentication via SSO does not register when a user logs off, like FSSO does with local AD. Instead, it uses a timeout value (default at 30 minutes) of when that device last sends/requests internet traffic. Once the 30 minutes is up, the user is de-authenticated and the FortiGate send another authentication request the next time any user using that devices access the internet. The trouble is, even without a user actually logged onto the machine, if the machine is still turned on then it still accesses the internet, for various things, so the timer does not reach 0 in that time. We did look at finding a way to send the logout url (https://:1003/logout? ) to the fortigate via script but got distracted with other priorities.

 

With the exception of the above issues its working pretty seamless for us, this handles all Windows devices. Currently iPads have a standard 'student' filtering policy across the board.

 

If anyone has any inputs/ideas on #2 or #3 that would be fantastic!

[RLR]

We were able to get it mostly running but did/do have a few issues:

 

1) We really struggled to get it working on FortiOS v7, we ended up sticking with the latest v6.4.xx - been running it for probably about a year now.

 

2) We had to use google.co.uk as the homepage to get the SSO work seamlessly, we tried Sharepoint and the school website but had real issues. Fortinet pointed us at https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/934626/captive-portals and https://www.chromium.org/chromium-os/chromiumos-design-docs/network-portal-detection/ and explained we had to use any website that supports 80/http to trigger the redirect for transparent/seamless SSO using the logged in user credentials.

 

3) We found that switching users or user log off did not force the authentication logout, rather if a teacher logged into a device then logged out, then a student logged in they would likely get the teacher permissions. In a nutshell, the firewall authentication via SSO does not register when a user logs off, like FSSO does with local AD. Instead, it uses a timeout value (default at 30 minutes) of when that device last sends/requests internet traffic. Once the 30 minutes is up, the user is de-authenticated and the FortiGate send another authentication request the next time any user using that devices access the internet. The trouble is, even without a user actually logged onto the machine, if the machine is still turned on then it still accesses the internet, for various things, so the timer does not reach 0 in that time. We did look at finding a way to send the logout url (https://:1003/logout? ) to the fortigate via script but got distracted with other priorities.

 

With the exception of the above issues its working pretty seamless for us, this handles all Windows devices. Currently iPads have a standard 'student' filtering policy across the board.

 

If anyone has any inputs/ideas on #2 or #3 that would be fantastic!

I set this up yesterday but couldn't get it to work properly. Kept getting an empty response error when the user logged in. This might have been a certificate issue or something else but I've had to revert the changes I made as other devices suddenly started to get certificate warnings when browsing the internet. I thought scoping the policy to my one device would only force that device to try auth via SAML but seems others where getting it also.

 

Did you need to setup the Captive Portal on the interface? The guide I followed didn't mention this but this may have also been part of my issue. Would like to test more but had a few too many users getting certificate errors.

[RobFuller]

I set this up yesterday but couldn't get it to work properly. Kept getting an empty response error when the user logged in. This might have been a certificate issue or something else but I've had to revert the changes I made as other devices suddenly started to get certificate warnings when browsing the internet. I thought scoping the policy to my one device would only force that device to try auth via SAML but seems others where getting it also.

 

Did you need to setup the Captive Portal on the interface? The guide I followed didn't mention this but this may have also been part of my issue. Would like to test more but had a few too many users getting certificate errors.

 

The empty response is exactly the error we were hitting.

 

I was investigating this form of authentication for our Entra only joined Windows devices but I really don't want to go back to the 30 min timeout days of Smoothwall so may look at 802.1x Auth options via Entra.

[free780]

We were able to get it mostly running but did/do have a few issues:

 

1) We really struggled to get it working on FortiOS v7, we ended up sticking with the latest v6.4.xx - been running it for probably about a year now.

 

2) We had to use google.co.uk as the homepage to get the SSO work seamlessly, we tried Sharepoint and the school website but had real issues. Fortinet pointed us at https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/934626/captive-portals and https://www.chromium.org/chromium-os/chromiumos-design-docs/network-portal-detection/ and explained we had to use any website that supports 80/http to trigger the redirect for transparent/seamless SSO using the logged in user credentials.

 

3) We found that switching users or user log off did not force the authentication logout, rather if a teacher logged into a device then logged out, then a student logged in they would likely get the teacher permissions. In a nutshell, the firewall authentication via SSO does not register when a user logs off, like FSSO does with local AD. Instead, it uses a timeout value (default at 30 minutes) of when that device last sends/requests internet traffic. Once the 30 minutes is up, the user is de-authenticated and the FortiGate send another authentication request the next time any user using that devices access the internet. The trouble is, even without a user actually logged onto the machine, if the machine is still turned on then it still accesses the internet, for various things, so the timer does not reach 0 in that time. We did look at finding a way to send the logout url (https://:1003/logout? ) to the fortigate via script but got distracted with other priorities.

 

With the exception of the above issues its working pretty seamless for us, this handles all Windows devices. Currently iPads have a standard 'student' filtering policy across the board.

 

If anyone has any inputs/ideas on #2 or #3 that would be fantastic!

 

I’m using the FSSO collector with Domain Controller Agents. It works most of the time. I had to enable remote registry on clients and allow SMB in from the collector server.

 

I tested the SAML method but thought a captive portal was a bit disruptive. If you’ve got the budget Forticlient might relay the logged on user.

[FN-GM]

I’m using the FSSO collector with Domain Controller Agents. It works most of the time. I had to enable remote registry on clients and allow SMB in from the collector server.

 

I tested the SAML method but thought a captive portal was a bit disruptive. If you’ve got the budget Forticlient might relay the logged on user.

 

Our cyber insurance doesn’t allow 3rd party services to be installed on domain controllers. It might reach you one day [emoji846]

[RLR]

The empty response is exactly the error we were hitting.

 

I was investigating this form of authentication for our Entra only joined Windows devices but I really don't want to go back to the 30 min timeout days of Smoothwall so may look at 802.1x Auth options via Entra.

We have a consultant coming in tomorrow that thinks we might be able to use our ClearPass system for user authentication on shared devices. I thought it would only be possible if the user was assigned to the device in inTune for example. Will let you know if we come up with anything.

[jslate1980]

I had a meeting last week to look at replacing our fortigate firewalls. I was told that fortinet have a cheaper solution to this issue than having to go with purchasing fortiauthentcator. Not had specifics yet but will update once we have costs.

[Roberto]

We have a consultant coming in tomorrow that thinks we might be able to use our ClearPass system for user authentication on shared devices. I thought it would only be possible if the user was assigned to the device in inTune for example. Will let you know if we come up with anything.

 

Been a long time but I’ve used clearpass for user auth with radius on WiFi before. Perfectly possible.

[RLR]

We do have the Seamless captive portal working now with our Fortigate. I followed the guide again and made sure to do the certificate part correctly which may have been the issue the first time I tried. Although this is working, it still doens't solve shared devices as the captive portal will stay signed in to the previous user or sometimes authenticate the current user incorrectly if there is someone else signed in. I have a login script that runs to open edge and go to the firewall logout page to get round this but seems a bit of a bodge. I think this captive portal would be really good in a non education business setting.

 

Been a long time but I’ve used clearpass for user auth with radius on WiFi before. Perfectly possible.

 

We have user auth setup already using certificates for 1:1 WiFi devices but the issue is shared devices. Intune doesn't instantly update certificates for when a new user signs in.

[tom_newton]

As far as I know there are still no decent options for 802.1x with cloud - Microsoft will still ask you to have something on-site, which is frustrating.

For managed devices my suggestion would be to look at on-device filtering, so usernames are automatically picked up.

[RobFuller]

After speaking with Fortinet, they have an agent you can push down to your clients for Entra joined machines but this requires FortiAuthenticator.

In the end I've decided it makes much more sense to go down the on device filtering route, for us we are going to use Lightspeed.

Edited June 3, 2024 by RobFuller

[Alawil]

We do have the Seamless captive portal working now with our Fortigate. I followed the guide again and made sure to do the certificate part correctly which may have been the issue the first time I tried. Although this is working, it still doens't solve shared devices as the captive portal will stay signed in to the previous user or sometimes authenticate the current user incorrectly if there is someone else signed in. I have a login script that runs to open edge and go to the firewall logout page to get round this but seems a bit of a bodge. I think this captive portal would be really good in a non education business setting.

 

 

 

We have user auth setup already using certificates for 1:1 WiFi devices but the issue is shared devices. Intune doesn't instantly update certificates for when a new user signs in.

 

Can you please share your script, and how did you run it - we are using intune?

[RLR]

Can you please share your script, and how did you run it - we are using intune?

 

I followed this guide to deploy a script that creates a Scheduled task that runs at user login and device unlock. This guide only deals with user login so I had to edit it a bit to include device unlock.

 

My scripts can be found here:

https://github.com/rlr47/ScheduledTaskFortigateSAMLLogout/tree/main/FirewallAuthScheduledTask

 

Take note of some of the comments. Like I said in my previous post, it's a bit of a bodge due to having to open up an edge page and then sending a keyboard command which will only work if the edge page is still the main selection.

 

I have added a possible alternative method to the ScripttoRun where it uses Invoke-WebRequest instead which means Edge doesn't need to open but haven't had time to test it yet.

 

Edit: The guide I posted also has the script run as system which isn't what we want. We need it to run as user so I also had to update that in my script.

Edited June 7, 2024 by RLR