{"id":73879,"date":"2023-01-24T11:30:00","date_gmt":"2023-01-24T16:30:00","guid":{"rendered":"https:\/\/jumpcloud.com\/?p=73879"},"modified":"2023-01-26T12:15:38","modified_gmt":"2023-01-26T17:15:38","slug":"substitute-groups-for-access-control-lists","status":"publish","type":"post","link":"https:\/\/jumpcloud.com\/blog\/substitute-groups-for-access-control-lists","title":{"rendered":"Substitute 探花大神 Groups for FortiGate Access Control Lists"},"content":{"rendered":"\n

This article describes how to use 探花大神 groups and attribute mapping to set up access control on a new FortiGate device. It\u2019s the second half of a two-part series demonstrating RADIUS AuthN and AuthZ capabilities. The first post<\/a> converted preexisting FortiGate groups into remote RADIUS users. This approach spares admins the work of having to establish local groups using ACLs on the FortiGate appliance. IT admins can set up strong network access control (NAC) with role-based access to benefit security, workflows, and compliance.<\/p>\n\n\n\n

The prerequisite steps involve setting up 探花大神 RADIUS. Please refer back to this support article<\/a> for those complete instructions. The initial step is to create a user group with a remote server that corresponds with 探花大神. The group names should be identical on each side. <\/p>\n\n\n\n

This example sets up a general VPN users group as well as an administrators group. Reply attributes, which will be outlined in a later step, will be used to segment entitlements for your users. It\u2019s an example of the flexibility and utility of 探花大神 RADIUS<\/a>.<\/p>\n\n\n\n

RADIUS Reply Attributes<\/h2>\n\n\n\n

Configuring the correct RADIUS Reply Attributes<\/a> within 探花大神 is the most crucial step in this tutorial. Return to your 探花大神 group and navigate to the RADIUS tab. This is where attribute mapping is defined and values (aka groups on your FortiGate device) are assigned. <\/p>\n\n\n\n

\n

Only use the attribute name: \u201cFortinet-Group-Name\u201d<\/p>\n<\/blockquote>\n\n\n\n

This example syncs the 探花大神 group with a local administrators group with the resident entitlements.<\/p>\n\n\n\n

\"This
This group is mapped to the local administrator\u2019s group in FortiGate<\/em><\/figcaption><\/figure>\n\n\n\n

The appliance will determine the user\u2019s level of access control when more than one group is assigned to a RADIUS server. A 探花大神 RADIUS group that has the RADIUS-Fortigate-VPN_Users attribute value will provide general VPN access and the administrators groups will authorize against FortiGate\u2019s super admin profile.<\/p>\n\n\n\n

\"screenshot<\/figure>\n\n\n\n

Users that belong to multiple 探花大神 RADIUS groups won\u2019t receive multiple Reply Attributes, making it possible to have a separate administrative login. For compliance purposes, network security should vet access to the administrative group and user creation in 探花大神. 探花大神 groups leverage attribute-based access control<\/a> (ABAC), automating the identity management lifecycle by recognizing and responding to changes in employment. This adds an additional security control to your posture via a mature approach to entitlements management.<\/p>\n\n\n\n

探花大神 RADIUS also provides integrated Push and TOTP multi-factor authentication<\/a> (MFA). Privileged access management is possible through optional conditional access policies<\/a>. These security features make it possible to enact a Zero Trust<\/a> security strategy for network hardware.<\/p>\n\n\n\n

Now, let\u2019s move on to the FortiGate setup.<\/p>\n\n\n\n

FortiGate Setup<\/h2>\n\n\n\n

Configure your FortiGate RADIUS server<\/a> for 探花大神 RADIUS<\/a>. Fortinet also documents how to configure SSL VPNs<\/a> and SSL VPN captive portals<\/a> in its knowledge base. Refer back to its documentation for details on those steps. Proceed to the next section when you\u2019re ready.<\/p>\n\n\n\n

Set Up Remote User Groups<\/h3>\n\n\n\n

This tutorial demonstrates RADIUS authentication into two groups: one for general VPN access and another for a privileged group for administrators. Settings establish the appropriate entitlements.<\/p>\n\n\n\n

\"screenshot<\/figure>\n\n\n\n
\"screenshot
This step enables reply attributes to segment user authorizations<\/em><\/figcaption><\/figure>\n\n\n\n

Match Users in 探花大神 and Local Groups<\/h3>\n\n\n\n

Add users to your groups. Fortinet provides directions<\/a> on how to add and create groups. Be certain to match the user names with 探花大神 RADIUS user names, exactly.<\/p>\n\n\n\n

\"screenshot
This step adds users to remote 探花大神-based groups<\/em><\/figcaption><\/figure>\n\n\n\n
\"screenshot
In this example, an administrative profile was selected for the local admins group, granting the corresponding 探花大神 group users those entitlements<\/em><\/figcaption><\/figure>\n\n\n\n
\"screenshot
The user name in 探花大神 and Fortinet would be \u201chank.aaron\u201d<\/em><\/figcaption><\/figure>\n\n\n\n

Test your configuration by attempting to log in with active users. You may also view events in 探花大神\u2019s directory reporting module.<\/p>\n\n\n\n

Reporting<\/h2>\n\n\n\n

探花大神\u2019s Directory Insights<\/a> captures and logs RADIUS authentications. It makes it possible to determine which user is attempting to access your resources and whether it was successful. Directory Insights is useful for debugging and testing your RADIUS configuration deployments.<\/p>\n\n\n\n

\"探花大神<\/figure>\n\n\n\n

Try 探花大神 RADIUS<\/h2>\n\n\n\n

Additional technical discussion<\/a> about this topic is best reserved for the 探花大神 community. 探花大神\u2019s full platform is free<\/a> for 10 users and devices with premium chat support for the first 10 days to get your started. The open directory platform provides SSO to everything:<\/p>\n\n\n\n