Technical Tip : FortiOS 4.0 MR2 Concurrent user name restriction feature

[Jonathan_Body_FTNT]

Description

This article explains how to enable the concurrent user name restriction feature that was introduced on the FortiGate in FortiOS 4.0 MR2.

Scope
FortiOS 4.0 MR2 and above.
Solution

This feature has been implemented in FortiOS to prevent users trying to spoof FortiOS Firewall Policy authentication by using valid domain user names to gain unauthorized access to the network.

When activated, the FortiGate checks and restricts concurrent access from the same user name, but using a different IP address.

To activate this profile on the CLI, perform the following:

#config system global
#set admin-concurrent enable/disable
#set policy-auth-concurrent enable/disable
#end

These options check existing firewall and admin users and will then restrict access when no match is found.