I85PREP
⌘ K
FCSS Enterprise Firewall 7.6 study materials
FCSS Enterprise Firewall 7.6 study resources

FCSS Enterprise Firewall 7.6: Firewall Authentication

FCSS Enterprise Firewall 7.6 · Work through your exam, one topic at a time.

All guide sections

Firewall Authentication

Firewall Authentication

This domain tests identity-based policy: how a FortiGate learns who a user is (local, LDAP, RADIUS, TACACS+, SAML, PKI, FSSO/RSSO), how it challenges them (active web authentication, captive portal, certificate), and how long that identity survives. Questions cluster around authentication rules, timeout behaviour, FSSO deployment modes and why an identity policy silently fails to match.

Core rules

  • Two halves. A policy with set users or set groups only matches traffic from an already-authenticated user; unauthenticated traffic is redirected to the authentication portal or falls to the implicit deny.
  • Active versus passive. Active means the user types credentials (web-auth over HTTP/HTTPS, or FTP/email through authentication rules). Passive means identity arrives from elsewhere: FSSO (DC agent, collector agent, or polling the domain controller) and RSSO (RADIUS accounting).
  • Authentication rules (config authentication rule) decide which protocol and path trigger a challenge, whether SSO is honoured, and whether a web-auth cookie is used.
  • Timeouts. auth-timeout at policy level caps the login; auth-timeout-type selects idle-timeout, hard-timeout, new-session or ip-based behaviour.
  • MFA. FortiToken (push or TOTP), SMS, email or a RADIUS challenge, configured on the user or group with set two-factor.
  • LDAP specifics. Bind DN and bind type, cnid (commonly sAMAccountName), group matching through an LDAP filter, and LDAPS on 636 when credentials cross an untrusted network.

Worked example

Domain users in CN=Staff must reach the internet only after authenticating, and FSSO is already deployed. Add the FSSO collector as a user source, create an fsso-type group whose name matches the AD group, and place the identity policy above the generic outbound policy. Reasoning: FSSO resolves the source IP to a user at session setup, so no portal appears; policy order decides everything because the first matching policy wins and a broad allow-any rule above it would bypass authentication entirely.

Traps

An allow-all policy above the identity policy; FSSO groups that do not match the AD group's distinguished name; short idle timeouts logging users out mid-session; testing LDAP with the wrong bind account; expecting a captive portal over HTTPS to work without a certificate users trust.