FortiGate Administration Guide - FirewallShop.com

Firewall Policy
Configuring firewall policies
Note: When you use certificate authentication, if you do not specify any certificate when
you create a policy, the global settings will be used. If you specify a certificate, the perpolicy
setting will overwrite the global setting. For information about user authentication
global settings, see “Authentication settings” on page 394.
User authentication supports the following protocols:
• HTTP
• HTTPS
• Telnet
• FTP
For information about configuring authentication protocols and other
authentication settings, see “Authentication settings” on page 394.
You can specify which protocol will be used to issue the authentication challenge.
The firewall policy must also include the authentication protocol for the end users
to be able to get authenticated. For example, if you are creating a POP3 policy,
and you have specified that HTTP protocol will be used for authentication, the
firewall policy services must include at least HTTP and POP3.
Figure 168:Selecting user groups for authentication
Select Authentication and select one or more user groups to require users to enter
a user name and password, or use certificates to authenticate, before the firewall
accepts the connection.
• The Firewall authentication method includes locally defined user groups, as
well as LDAP, and RADIUS users.
• Select Active Directory from the drop-down list to choose Active Directory
groups defined in User > User Group. Authentication with Active Directory
groups and other groups cannot be combined in the same policy.
• To use NTLM authentication, select NTLM from the drop-down list and choose
Active Directory groups defined in User > User Group. You use AD groups as
the members of the authentication group for NTLM.
Note: To allow the FortiGate unit to authenticate with an Active Directory server, the
Fortinet Server Authentication Extensions (FSAE) must be installed on the Active Directory
Domain Controller. FSAE is available from Fortinet Technical Support.
In most cases, ensure users can use DNS through the firewall without
authentication. If DNS is not available, users cannot connect to a web, FTP, or
Telnet server using a domain name.
Note: Policies that require authentication must be added to the policy list above matching
policies that do not; otherwise, the policy that does not require authentication is selected
first.
FortiGate Version 3.0 MR5 Administration Guide
01-30005-0203-20070830 277