{"id":62903,"date":"2022-05-13T11:00:00","date_gmt":"2022-05-13T15:00:00","guid":{"rendered":"https:\/\/jumpcloud.com\/?p=62903"},"modified":"2024-01-29T14:58:13","modified_gmt":"2024-01-29T19:58:13","slug":"supercharge-fortinet-vpn-security-with-mfa-sso-and-conditional-access","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/supercharge-fortinet-vpn-security-with-mfa-sso-and-conditional-access","title":{"rendered":"Supercharge Fortinet NGFW Security with 探花大神 SSO and Conditional Access"},"content":{"rendered":"\n

IT organizations have made significant investments into security solutions, and firewalls (with VPNs) are among the most expensive. Unfortunately, network appliances are too frequently not unified with other infrastructure such as identity and access Management (IAM), which leaves gaps in the implementation of Zero Trust security strategies<\/a>. <\/p>\n\n\n\n

There\u2019s an awareness that IT should be doing more, but cost, complexity, and management overhead are often major roadblocks. <\/p>\n\n\n\n

探花大神 removes these impediments and makes it possible to maximize your Fortinet investment by leveraging its built-in capabilities in conjunction with the 探花大神 directory platform\u2019s layers of security. 探花大神\u2019s IAM security controls supercharge firewall and SSL VPN management and security through its directory, conditional access policies, and multi-factor authentication (MFA). <\/p>\n\n\n\n

Those capabilities are otherwise unavailable on a Fortinet appliance or involve additional costs and vendors. This configuration also reduces the firewall\u2019s footprint on the open web, reducing the potential attack surface area with 探花大神\u2019s IAM.<\/p>\n\n\n\n

This article demonstrates how to easily integrate 探花大神 with your Fortinet appliance, beyond single sign-on (SSO), to significantly increase your overall network security posture.<\/p>\n\n\n\n

\"Video<\/a>\n\n\n\n

探花大神 Adds Zero Trust Security, Intelligent Management<\/h2>\n\n\n\n

探花大神 leverages Fortinet\u2019s integrated support for single sign-on (SAML SSO) to direct users to the 探花大神 portal for authentication. That\u2019s where a Zero Trust authentication flow occurs before<\/em> access is permitted to a VPN (for users) or firewall console (for admins). <\/p>\n\n\n\n

There\u2019s no third-party MFA solution (or FortiTokens) to manage and the user experience is consistent for anyone who\u2019s accustomed to using 探花大神 SSO to access their apps and other resources.<\/p>\n\n\n\n

Unified Zero Trust Security<\/h3>\n\n\n\n

Conditional access policies layer on additional security that\u2019s not available through standard identity management integrations such as Active Directory or even with MFA alone. 探花大神 adds the option to restrict connections to managed devices and specified geographies, and enforces mandatory MFA for every login. It\u2019s a unified system for all of your access control requirements.<\/p>\n\n\n\n

Smarter User Management<\/h3>\n\n\n\n

Access to a VPN (or admin group) is determined by group membership inside of 探花大神\u2019s cloud LDAP directory. IAM is in effect from the initial user onboarding via HRIS integrations (or SCIM provisioning), onward throughout the user\u2019s complete identity lifecycle. <\/p>\n\n\n\n

For instance, attribute-based access control<\/a> (ABAC) can suggest new group members or identify when a user shouldn\u2019t have access to a particular resource if their role within your organization changes.<\/p>\n\n\n\n

This capability will function using 探花大神 by itself or in addition to existing directories such as Active Directory, Azure AD, or Google Workspace. The choice is up to the IT administrator.<\/p>\n\n\n\n

Integrate 探花大神 with Fortinet NSFWs, SSL VPN<\/h2>\n\n\n\n

Let\u2019s begin by outlining the Fortinet portion of the integration, followed by 探花大神\u2019s setup. It\u2019s helpful to have an understanding of Fortinet\u2019s command line interface (CLI) to streamline the process. It\u2019s possible to then use the GUI to make changes and verify your configurations.<\/p>\n\n\n\n

Fortinet Setup<\/h3>\n\n\n\n

The initial setup establishes the SAML service provider (Fortinet) and identity provider (探花大神). These settings must be identical when you enter them into the 探花大神 admin console in later steps to prevent SAML SSO integrations from producing unknown errors.<\/p>\n\n\n

<\/p>\n\n\n\n

# config user saml<\/p>\n\n\n\n

    edit “jumpcloud”<\/p>\n\n\n\n

        set cert “Fortinet_Factory”<\/p>\n\n\n\n

        set entity-id “<IP or FQDN>:8443\/remote\/saml\/metadata\/”<\/p>\n\n\n\n

        set single-sign-on-url “<IP or FQDN>:8443\/remote\/saml\/login\/”<\/p>\n\n\n\n

        set single-logout-url “<IP or FQDN>:8443\/remote\/saml\/logout\/”<\/p>\n\n\n\n

        set idp-entity-id “https:\/\/sso.jumpcloud.com\/saml2\/saml2\/探花大神Forti”<\/p>\n\n\n\n

        set idp-single-sign-on-url “https:\/\/sso.jumpcloud.com\/saml2\/探花大神Forti”<\/p>\n\n\n\n

        set idp-single-logout-url “https:\/\/console.jumpcloud.com\/userconsole”<\/p>\n\n\n\n

        set idp-cert “REMOTE_Cert_2”<\/p>\n\n\n\n

        set user-name “email”<\/p>\n\n\n\n

    next<\/p>\n\n\n\n

End<\/p>\n\n\n

<\/code><\/p>\n\n\n\n

The GUI will display the following, with slight variations such as whether you\u2019ve previously imported a SSL certificate. This example lists \u201cREMOTE_Cert_3,\u201d but the difference is superficial. You may also opt to use a different attribute for authentication such as \u201cusername.\u201d<\/p>\n\n\n\n

\"Identity<\/figure>\n\n\n\n
\"Edit<\/figure>\n\n\n\n
\"Additional<\/figure>\n\n\n\n

Note that it\u2019s a best practice to replace the default unsigned SSL certificate with one that\u2019s issued by a certificate authority (CA). There\u2019s a built-in interface to use Let\u2019s Encrypt as your CA.<\/p>\n\n\n\n

Next, we\u2019re going to first configure the Fortigate SSO user group, followed by the optional step of establishing an SSL VPN configuration, authentication rule, and the requisite firewall rules.<\/p>\n\n\n

<\/p>\n\n\n\n

# config user group<\/p>\n\n\n\n

edit “ssl-saml-group”<\/p>\n\n\n\n

     set member “jc-saml-vpn”<\/p>\n\n\n\n

next<\/p>\n\n\n\n

End<\/p>\n\n\n

<\/code><\/p>\n\n\n\n

These firewall rules, derived from a Fortinet support article<\/a>, are only applicable if you don\u2019t have an existing SSL VPN that has established access control lists and IP assignments. Skip this section if it doesn\u2019t apply.<\/p>\n\n\n

<\/p>\n\n\n\n

# config vpn ssl settings<\/p>\n\n\n\n

set servercert “self-sign”<\/p>\n\n\n\n

set tunnel-ip-pools “SSLVPN_TUNNEL_ADDR1”<\/p>\n\n\n\n

set tunnel-ipv6-pools “SSLVPN_TUNNEL_IPv6_ADDR1”<\/p>\n\n\n\n

set port 8443<\/p>\n\n\n\n

set source-interface “port1”<\/p>\n\n\n\n

set source-address “all”<\/p>\n\n\n\n

set source-address6 “all”<\/p>\n\n\n\n

set default-portal “web-access”<\/p>\n\n\n\n

    # config authentication-rule<\/p>\n\n\n\n

     edit 1<\/p>\n\n\n\n

         set groups “ssl-saml-group”<\/p>\n\n\n\n

         set portal “web-access”<\/p>\n\n\n\n

     next<\/p>\n\n\n\n

end<\/p>\n\n\n\n

end<\/p>\n\n\n\n

# config firewall policy<\/p>\n\n\n\n

edit 1<\/p>\n\n\n\n

     set name “samltest\u201d<\/p>\n\n\n\n

     set srcintf “ssl.root\u201d<\/p>\n\n\n\n

     set srcaddr “all”<\/p>\n\n\n\n

     set dstaddr “all”<\/p>\n\n\n\n

     set action accept<\/p>\n\n\n\n

     set schedule “always”<\/p>\n\n\n\n

     set service “ALL”<\/p>\n\n\n\n

     set logtraffic all<\/p>\n\n\n\n

     set groups “ssl-saml-ngrp”<\/p>\n\n\n\n

     set nat enable<\/p>\n\n\n\n

next<\/p>\n\n\n

<\/code><\/p>\n\n\n\n

I followed the steps above for my initial setup in preparation for this article. I find it important to tune my configuration by specifying how IPs are assigned (as well as defining a range) and to modify whether users may access the VPN using FortiClient applications. <\/p>\n\n\n\n

However, you should consult your own policies and work with your Fortinet rep if you need any guidance on this. <\/p>\n\n\n\n

An example of a tuned configuration is shown below. <\/p>\n\n\n\n

<\/p>\n\n\n\n

\"IF<\/figure>\n\n\n\n
\"Limit<\/figure>\n\n\n\n

You\u2019re now ready to move on to the 探花大神 portion of the SSO integration, but keep your Fortinet instance open to retrieve SAML field information and your local SSL certificate.<\/p>\n\n\n\n

探花大神 Setup<\/h3>\n\n\n\n

Your first task is to create a custom SSO connector for Fortinet, but be sure to check and see whether a pre-built connector is available to you. 探花大神 provides hundreds of free connectors as part of your subscription and regularly adds new ones for its users.<\/p>\n\n\n\n

Create a SAML Connector<\/h4>\n\n\n\n

Navigate to the SSO button in the left panel of your administrative console and hit the \u201cplus\u201d sign. Then, select \u201cCustomer SAML App\u201d (if you\u2019ve searched for a Fortinet connector and there is not one present in the catalog). You may label your connector as well as create a color scheme and logo; this SAML how-to article<\/a> goes into greater detail about the steps that are outlined below. <\/p>\n\n\n\n

This is the one that we created for this article, as an example.<\/p>\n\n\n\n

\"SAML<\/figure>\n\n\n\n

The next step is to navigate to the SSO tab. You\u2019ll set an Entity ID that\u2019s unique to your organization\u2019s environment. It\u2019s important to note that this and all the other settings on this screen are case-sensitive on both systems; any typo will result in errors and the integration will fail. Note: It\u2019s a best practice to export\/import metadata, but that\u2019s not an option on the Fortigate GUI.<\/p>\n\n\n\n