FortiGate Administration Guide - FirewallShop.com

User
User groups
User group types
You can configure user groups to provide authenticated access to:
• Firewall policies that require authentication
See “Adding authentication to firewall policies” on page 276.
• SSL VPNs on the FortiGate unit
See “SSL-VPN firewall policy options” on page 281.
• IPSec VPN Phase 1 configurations for dialup users
See “Creating a new phase 1 configuration” on page 345.
• XAuth for IPSec VPN Phase 1 configurations
See XAUTH in “Defining phase 1 advanced settings” on page 348.
• FortiGate PPTP configuration
See “PPTP Range” on page 361.
• FortiGate L2TP configuration
This is configurable only using the config vpn l2tp CLI command. See
the FortiGate CLI Reference.
• Administrator login with RADIUS authentication
See “Configuring RADIUS authentication for administrators” on page 163.
• FortiGuard Web Filtering override groups
See “FortiGuard - Web Filter” on page 435.
For each resource that requires authentication, you specify which user groups are
permitted access. You need to determine the number and membership of user
groups appropriate to your authentication needs.
There are three types of user group:
• Firewall
• Active Directory
• SSL VPN
Firewall
A firewall user group provides access to a firewall policy that requires firewall type
authentication and lists the user group as one of the allowed groups. The
FortiGate unit requests the group member’s user name and password when the
user attempts to access the resource that the policy protects. A user may also be
authenticated by certificate if this method is selected in the firewall policy. For
more information, see “Adding authentication to firewall policies” on page 276.
A firewall user group can also provide access to an IPSec VPN for dialup users. In
this case, the IPSec VPN phase 1 configuration uses the Accept peer ID in dialup
group peer option. The user’s VPN client is configured with the user name as peer
ID and the password as pre-shared key. The user can connect successfully to the
IPSec VPN only if the user name is a member of the allowed user group and the
password matches the one stored on the FortiGate unit. A user group cannot be a
dialup group if any member is authenticated using a RADIUS or LDAP server. For
more information, see “Creating a new phase 1 configuration” on page 345.
FortiGate Version 3.0 MR5 Administration Guide
01-30005-0203-20070830 387