This article provides instructions for configuring single-use LDAP Fortigate Firewall Get user information from the Domain controller to apply policies to AD users right on the Fortigate device. The article uses a model with IP addresses set as follows:
To Fortigate To authenticate users on AD, we must perform 3 steps:
– Prepare on AD
– Create LDAP server
– Map AD users to Fortigate devices
Start configuration
Step 1: On Domain controller:
On AD, create an OU (Organizational Unit), then put all users that need to be managed on the Firewall into this OU.
In the command line window type the command: dsquery user
Record the parameters CN, OU, DC
In addition, on AD there is no need to perform any additional operations or install any other software.
Step 2: Configure LDAP above Fortigate Firewall
Go to User & Device -> Authentication-> LDAP Servers, declare the following parameters:
+ Name: Set arbitrarily
+ Server Name/IP: set the IP address of AD
+ ServerPort: default to 389
+ Common Name Identifier: default to “cn”
+ Disiguished Name: put in the correct order as OU then the name of the domain, the domain name is written in the form “DC=…” For example: “thegioimang.vn” is rewritten as “DC=thegioimang,DC=vn” The components are separated by commas, according to the parameters noted above.
+ Bind type, select Regular.
+ User DN: Enter all fields as noted above, in which the CN field is to enter the user used to authenticate with AD.
+ Password: enter the password of the user declared above.
After declaring the parameters, click Test, if there is a Success message, we have successfully connected to AD
Step 3: Map users on AD to the device.
Go to User & Device -> User-> User Definition, select Create new
In the window that appears, select the remote LDAP User then click Next.
In the next window, select the LDAP server you just configured
Next, we select the users we need to map to in the next window, then click Next
Step 4: Confirm Selection, click Done to finish.
Go back to User -> User Definition, we will see the new users have been successfully mapped, Type is LDAP (User created on Fortigate has type LOCAL).
For users that have been imported from AD, we can use it to impose policies, allow VPN connections… depending on our requirements. The article has been successfully tested on Windows server 2003, 2008 and 2012.
We are all successful.
Xem tiếp...
