FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Starting with MR3, FortiOS 3.0 supports integration with an Active Directory (AD) environment that employs NTLM messaging to provide authentication where the Fortinet Server Authentication Extension (FSAE) cannot be employed on all domain controllers. The controller agent must still be installed on at least one domain controller.
Background
The FSAE software is installed on each AD server and the FortiGate unit is configured to communicate with each FSAE client. When a user successfully logs into their Windows PC (and is authenticated by the AD Server), the FSAE client communicates the user's name, IP address, and group login information to the FortiGate unit. The FortiGate unit sets up a temporary access policy for the user, so when they attempt access through the firewall they do not need to re-authenticate. This model works well in environments where the FSAE client can be installed on all AD servers.
In system configurations where it is not possible to install FSAE clients on all AD servers, the FortiGate unit must be able to query the AD servers to find out if a user has been properly authenticated. This is achieved using the NTLM messaging features of Active Directory and Internet Explorer.
Even when NTLM authentication is used, the user is not asked again for their user name and password. Internet Explorer stores the user’s credentials and the FortiGate unit uses NTLM messaging to validate them in the Windows AD environment.
Note: If the authentication reaches the timeout period, the NTLM message exchange restarts.
Components
Microsoft Windows network with Active Directory (AD) servers
FortiGate unit
Client PCs running Windows operating system and using Internet Explorer
Configuration
To select the NTLM method of user authentication on the FortiGate unit
Go to Firewall> Policy.
Select the Edit icon for the firewall policy you want to modify.
Select Authentication and then select NTLM Authentication from the list.
In the Available Groups list, select the user groups who can authenticate to this firewall policy. Select the right arrow button to move them to the Allowed list.
