FortiGate RADIUS Single Sign-On (RSSO) with Windows Server 2008 Network Policy Server (NPS) VERSION 5.2.3

(1)

FortiGate RADIUS Single Sign-On (RSSO) with

Windows Server 2008 Network Policy Server (NPS)

(2)

Introduction

The purpose of this guide is to provide a known working configuration of RADIUS single sign-on using the following components:

 FortiGate (FortiOS 5.2.3)

 Windows Network Policy Server (Windows Server 2008 R2)  FortiAP (v5.0-build0086)

 Windows laptop supporting 802.1X wireless authentication

This guide assumes that you have a working wireless authentication infrastructure as configuring that using the referenced components above is out of the scope of this document. This guide also assumes that Virtual Domains are not enabled on the FortiGate.

Audience

This guide is written for the network and security administrators that have intermediate expertise in the following domains:

 Microsoft Windows Server Administration  FortiOS

 Access Points (AP)  Windows OS

RADIUS Single Sign-On (RSSO) Overview

What is Single Sign-On?

Single sign-on (SSO) is a property of access control of multiple related, but independent software systems. With this property a user logs in once and gains access to all systems without being prompted to log in again at each of them. (Reference: http://en.wikipedia.org/wiki/Single_sign-on)

In the case of FortiGate, it means harnessing a previous authentication attempt (i.e. an Active Directory domain log on, 802.1X wireless authentication, etc.) to reconcile IP addresses to a username as well as assign privilege to a user without prompting authentication from the client.

RSSO Use Case

(4)

knowledge of the wireless interface IP address and therefore, the user is no longer authenticated to the firewall. The user could go through the cumbersome task of signing out of their desktop and re-signing in (to make the authentication request from their wireless IP), however this is not preferred.

RSSO bridges this gap by harnessing the wireless authentication (802.1X) request from the RADIUS server authenticating that request via RADIUS accounting. Essentially RADIUS accounting captures valid logon information which identifies when a valid session starts and ends. In this deployment, the

FortiGate wireless controller forwards its accounting packets to the RADIUS server who then injects those packets to the RSSO agent listening on the FortiGate.

Authentication Flow

1. Host authenticates to wireless AP via 802.1X

2. AP validates user credentials from host at RADIUS server

3. RADIUS servers authorizes user for access and sends request back to AP to allow connection 4. AP allows host to establish wireless connection

5. WLC (FortiGate) sends accounting packets to RADIUS server

6. RADIUS server proxies those accounting packets and forwards it to the FortiGate 7. FortiGate registers authentication via received accounting packets

RADIUS Single Sign-On (RSSO) Configuration

There are three main components to be configured to support this functionality. The steps in this guide will be specific to the FortiGate, FortiAP and Windows Server 2008 R2 NPS, however can be adapted to other solutions as long as they support the required set of features.

FortiGate

The FortiGate serves as the wireless controller (WLC) for the FortiAP and the centralized authentication point for hosts on the network. There are three components of configuration:

1. RSSO Accounting Listener

*Please Note: The FortiGate listens on port 1813 for accounting packets.*

2. RADIUS Accounting

3. RSSO Group creation based on attribute sent in RADIUS accounting packets

At the conclusion of this section, the FortiGate will be listening for accounting messages from an external RADIUS server as well as send accounting packets when the FortiAP authenticates a user via 802.1X. Also, there will be a new user RSSO group that can be used with identity based policies on the FortiGate firewall policies.

RADIUS Accounting Listener

(5)

Figure 1. – Screenshot of WebGUI displaying “Single Sign-On” configuration 3. Click “Create New”

Figure 2. – Screenshot of “Single Sign-On” configuration page

(6)

4. Under the “New Single Sign-On Server” section: a. Select “RADIUS Single-Sign-On Agent” b. Check “Use RADIUS Shared Secret”

c. Populate the “Shared Secret” with that of the NPS d. Check “Send RADIUS Responses”

e. Click “OK”

Figure 3. – Screenshot of “New Single Sign-On Server” configuration page 5. Connect to the CLI of the FortiGate with an administrative user

6. Modify the “RSSO Agent” configuration with the RADIUS attribute that will be used from the AP to denote username:

config user radius edit "RSSO Agent" set rsso enable

set rsso-radius-response enable set rsso-validate-request-secret enable set rsso-secret ENC

uq7eceRhIZ1qkPIpmdZq1rfZabcJu/E6LH4aZqkgRZO8bxkEZoFh5LeRfVr4NrTk66SxS5gYHjc n/owXrRXVCtlWET+i05cRi+q/APdtgfWUSYLNWwzyg1esGanr2tnPg/ew3zTwq95PCItH5G dH6Zan9ARzv0mcbZ6zVOYlrwJ+EDPn+UN29x5+tb/9pLc7McNhjQ==

set rsso-endpoint-attribute User-Name next

end

*Please note: The RADIUS attribute used by FortiAP to denote user is “User-Name”. Please check your AP vendor’s specific documentation to find out their corresponding attribute for this field in their RADIUS accounting packets.*

RADIUS Accounting from FortiAP

1. Log into the CLI of the FortiGate

(7)

config user radius edit "localnet-RAD" set server "10.0.23.5" set secret ENC

L0weOHdu2c6EphF1QBlR65DcMeU1UTHprM6IMtt1J0tTJc48WNpB7xCGm/pTo1oSL8VM PalPC6/Fs02Jb/rF+Pq9vhiLNxcOSGAfSNiNrZAmuBdmJbdixjgjFrHd5yRRCvCfay5ppJ0byxQ UOEaWYYtxsHcRZEQvYAc3c6vKyW6sqhlHiyy5zurJ4K92DKgSX3iuMg==

set auth-type ms_chap_v2 config accounting-server edit 1

set status enable set server "10.0.23.5" set secret ENC

7P0tU/qGCV+ZpQSTSBa4OMKjAXeAoyPC3SuOodtdE7EnFg+AqzP6xssMOUeR4LvGjGz0 AtZcgmKUvELSIalskQJi7csfoJiZr5iv+swapPrWlOmR0Y+bJ5OgBfg6M8bqJ5km4XamCvld A7aau1t4e2mQ6KR6J3nwcJVtp5kbzh70fEcV4g/+NZ6aNgVbUriHNKHbtg== next end next end

*Please Note: The accounting packets are sent to port 1813 of the specified server*

RADIUS Group Matching

The identity based policies can be used to provide access through the FortiGate via the attribute matched by this group.

(8)

2. Click on “User & Device | User | User Groups”

Figure 4. – Screenshot of “User Groups” in WebGUI 3. Click “Create New”

Figure 5. – Screenshot of “User Groups” 4. In the Edit User Group Page:

a. Type in a “Name” for the user group

b. Select “RADIUS Single Sign-On (RSSO)” as type c. Type in “RADIUS Attribute Value” for the group d. Click “OK”

(9)

Microsoft Network Policy Server (NPS)

The Microsoft NPS provides the authentication and proxy accounting functionality in this environment. When users authenticate for access to the AP, the NPS will also respond with a RADIUS attribute that contains the specific class (group) that the user belongs to. This attribute can be used to create identity based policies which govern the access of that user based on that group rather than IP address alone. At the end of this section, the NPS will be configured to:

1. Authenticate users and return the correct attribute based on Windows group 2. Forward RADIUS accounting packets to the FortiGate for RSSO

Remote RADIUS Server Groups

1. In the “Network Policy Server” click “NPS (Local) | RADIUS Clients and Servers” 2. Right-Click “Remote RADIUS Server Groups” | Select “New”

Figure 7. – Screenshot of NPS RADIUS Server Group 3. Type in a “Group Name” | Click “Add”

(10)

4. Under the “Address” tab, put in the IP address of the FortiGate

(11)

5. Click on the “Authentication/Accounting” tab

a. Un-check “Use the same shared secret for authentication and accounting” in the Accounting section

b. Type in the “Shared Secret”

c. Check “Forward network access server start and stop notifications to this server” d. Click “OK”

Figure 10. – Screenshot of “RADIUS Server” dialog box

RADIUS Connection Request Policy

1. In the Network Policy Server

(12)

2. Provide “policy name” | Click “Next”

(13)

3. Under the Conditions Page | Click “Add”

Figure 12. – Screenshot of “Specify Conditions” dialog 4. In the “Select Conditions” dialog:

(14)

5. Choose all time periods | Click “ Permitted” | Click “OK”

Figure 14. - Screenshot of “Day and time restrictions” 6. Click “Next”

7. In the “Specify Connection Request Forwarding” dialog a. Click “Accounting”

b. Check the “Forward accounting requests to this remote RADIUS server group” c. Select the FortiGate accounting group created from the drop down box d. Click “Next”

(15)

9. On the “Configure Settings” page, Click “Next”

10. On the “Completing Connection Request Policy Wizard” page, click “Finish”

RADIUS Network Policy

1. In the Network Policy Server a. Click on “Policies”

b. Right-Click “Network Policies” c. Click “New”

(16)

2. Type a “Policy name” | Click “Next”

(17)

3. In the “Specify Conditions” dialog box | Click “Add”

Figure 18. – Screenshot of the “Specify Conditions” dialog box

(18)

6. Type in the security group that the users are a member of (i.e. Domain Admins) | Click “OK” | Click “OK”

(19)

8. In the “Specify Access Permission” | Select “Access granted” | Click “Next”

(20)

9. In the “Configure Authentication Methods” dialog: a. In the EAP Section, click “add”

b. Select “Microsoft: Protected EAP (PEAP)” c. Click “OK”

d. Click “Next”

(21)

11. In the “Configure Settings” dialog:

a. Under “RADIUS Attributes” | Select “Standard” b. Click “Add”

(22)

12. In the “Add Standard RADIUS Attribute” dialog: a. Select the “Class” attribute

b. Click “Add”

Figure 24. – Screenshot of “Add Standard RADIUS Attribute” dialog 13. In the “Attribute Information” dialog:

a. Choose “String” for the “attribute value in:”

b. Type the name of the attribute to be matched for the group (i.e. unrestricted) c. Click “OK”

Figure 25. – Screenshot of “Attribute Information” dialog 14. Click “Close”

(23)

Figure 26. – Screenshot of “Configure Settings” dialog

(24)

Figure 27. – Screenshot of “Completing New Network Policy” summary

RADIUS Single Sign-On (RSSO) Verification

To verify correct configuration of these parameters, there are a few methods to validate successful logons via RSSO. Those methods are:

 Firewall User Monitor via FortiGate WebGUI  RADIUS Daemon Test via FortiGate CLI  Packet Captures

Verification methods for Windows Network Policy Server is out of the scope of this document.

Firewall User Monitor

The Firewall user monitor provides a snapshot of the active authentication sessions registered with the FortiGate. To access this in the FortiGate GUI:

(25)

2. Click on “User & Device | Monitor | Firewall”

Figure 28. – Screenshot of Firewall user monitor in FortiGate WebGUI

RADIUS Daemon

The RADIUS daemon provides access to debug level information about RSSO logons. To access this information:

1. Log into the FortiGate CLI with administrative credentials 2. Execute the following command:

# diag test application radius 3 This returns the following output:

"index","time left","ip","endpoint","block status","log status","profile group","ref count","use default profile"

1,07:54:35,"172.16.230.2","LOCALNET\rsso_user","allow","no log","restricted",1,No

A list of all options associated with this command can be obtained by running the following command: diag test application radius <enter>

Packet Captures

(26)

Figure 29. – Screenshot of RADIUS accounting START packet with all required information

For more information on how to use packet captures on the FortiGate, consult the following Fortinet knowledgebase articles:

How to create a packet capture using the built-in GUI tool

http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD35380

Troubleshooting Tool : Using the FortiOS built-in packet sniffer

(27)

FortiGate RADIUS Single Sign-On (RSSO) with Windows Server 2008 Network Policy Server (NPS) VERSION 5.2.3