Fortinet

This guide explains the ways to integrate Fortinet (FortiGate) with Ironchip: SSL VPN with SAML, SSL VPN with RADIUS through NPS, and remote access IPsec with SAML.

SSL VPN with SAML

Integrate the FortiGate SSL VPN with Ironchip authentication through SAML.

Requirements

• Access to the Ironchip admin console.
• A user with permissions to make changes in Fortinet.

Configure Ironchip

1. In the Ironchip admin console, go to Applications and click the green New application button.

   

2. Select the SAML type and download the metadata with Download metadata file. You use it in the next steps.

   

You come back to this application later to finish the configuration.

Configure FortiGate

1. In the FortiGate admin interface, go to User & Authentication > Single Sign-On and click Create New, at the top left.

   

2. Set these parameters, all of them required:

   • Name: a descriptive name.
   • Address, under Service Provider Configuration: the public IP address the authentication request is sent to. It is usually the same IP as the VPN.
   • Entity ID, Assertion consumer service URL and Single logout service URL: the URLs Ironchip uses to communicate with Fortinet.
   • Certificate: the Fortinet certificate to use.

   

3. Click Next. The second section is edited with commands: click Edit in CLI.

   

4. In the console that opens, run these commands and replace <VPN IP> with the IP of your VPN:

   set entity-id "https://<VPN IP>/remote/saml/metadata/"
   set single-sign-on-url "https://<VPN IP>/remote/saml/login"
   set single-logout-url "https://<VPN IP>/remote/saml/logout"
   end

5. Close the terminal and click Cancel. This prevents the default values from being restored.

Back to Ironchip: FortiGate metadata

In the Ironchip application you must enter the metadata URL it uses to communicate with Fortinet.

1. Open a terminal in Fortinet and run:

   diag vpn ssl saml-metadata "<SAML NAME HERE>"

2. Upload the output to a public internet address and copy its raw URL.

3. Paste that URL into the Metadata URL field of the Ironchip application.

   

4. Click Add service to finish the configuration in Ironchip.

Note

In the current version of the console, the SAML application has the Service Provider (SP) section with the SP Metadata field, which accepts URL, Text and File. Select Text, paste the command output and click Import, as in IPsec with SAML: you do not need to upload it to a public address.

Finish the FortiGate configuration

Go back to the Fortinet screen where you left off. Keep the metadata file you downloaded from Ironchip open.

1. In Type, select Custom.

2. Fill in the IdP URLs with the data from the metadata file:

   • EntityID: the entityID property of the EntityDescriptor XML tag.
   • Assertion consumer service URL: the Location property of the SingleSignOnService XML tag.
   • Single logout service URL: the Location property of the SingleLogoutService XML tag.
   • Certificate: create a file with the .crt extension and paste into it the output of entering the content of the X509Certificate XML tag from the metadata file in the first field of SAML Tool. Both certificates are identical.

3. Enter the attributes:

   • Attribute used to identify users: urn:oid:0.9.2342.19200300.100.1.1
   • Attribute used to identify groups: urn:oid:1.3.6.1.4.1.5923.1.1.1.1

   

4. Click Submit to save the configuration.

Additional configuration

1. Create a group that has the Fortinet SSO configuration as a member.

   

2. Add the group to the SSL VPN configuration, in Authentication/Portal Mapping.

   

3. Add the group to the VPN policy, in the Source section.

   

4. Configure the authentication timeouts. Open a Fortinet terminal with the icon in the upper right corner and run these commands, which give the users of the associated group 60 seconds to authenticate:

   config user group
   edit <PROTECTED_USER_GROUP_NAME>
   set authtimeout 60
   end

   config system global
   set remoteauthtimeout 60
   end

SAML and password authentication at the same time (optional)

For users to be able to sign in both with SAML and with a local password, choose one of these options.

Option 1. Add the local users to the group you created earlier.

Option 2. Create a new group with the local users.

Then add that group to SSL-VPN Settings and to the policy you created earlier.

SSL VPN with RADIUS

Set up the RADIUS service in Fortinet and integrate it with an NPS server in an Active Directory environment.

Requirements

• A working Active Directory.
• The NPS role installed on a Windows Server and protected by Ironchip. See Microsoft NPS.
• An MFA application created in the Ironchip admin console.
• The Ironchip app downloaded.

Configure NPS

1. On your AD server, open the NPS (Network Policy Server) configuration and create a new RADIUS client that points to the Fortinet IP.

   

2. Enter these details:

   • A descriptive name for RADIUS.
   • The IP of Fortinet.
   • A secret key for RADIUS.

   

Users and groups in FortiGate

1. Open the Fortinet configuration panel in a browser, using the IP of your Fortinet device.

   

2. Go to User & Authentication > RADIUS Servers and add a new one.

   

3. Fill in the details: a descriptive name, the IP of the server where you created RADIUS, and the RADIUS secret.

   

4. To confirm that it connected correctly, click Test Connectivity. If the result is Successful, click Test User Credentials and sign in with a user from your domain. If it fails, check that the Windows Server firewall has an inbound rule that allows RADIUS (UDP) traffic from the Fortinet IP.

5. Create a group and users that refer to the domain in Fortinet. Go to User & Authentication > User Groups and add a new one.

   

6. Give it a name, select Firewall and in Remote groups select your RADIUS server.

   

7. To configure the users, go to the User Definition tab and repeat these steps for each user:

   1. Click Create New.
   2. Select Remote RADIUS User.
   3. Enter the user in domain\username format and select the RADIUS server you created earlier.
   4. Leave Two-factor disabled.
   5. Enable User Group and select the group you created.

Creating remote RADIUS users in FortiGatePlay video

Attribute in the network policy (optional)

To avoid creating the users one by one, add an attribute to the domain network policy.

1. Open Network Policy Server.

   

2. Go to Policies > Network Policies and double-click the policy.

   

   

3. Go to Settings, under RADIUS Attributes select Vendor Specific and click Add.

   

4. In the Vendor drop-down, select Custom and then the vendor-specific option.

   

5. Click Add. This window appears:

   

6. Click Add and set the next window as shown:

   

7. Click Configure Attribute and in the window that appears set:

   1. Vendor-assigned attribute number: 1.
   2. Attribute format: String.
   3. Attribute value: the group you created earlier in Fortinet.

   

Configure the VPN

1. Go to VPN > SSL-VPN Settings.

   

2. Modify the fields as follows:

   • Select the interfaces you will use, such as the WAN or LAN.
   • Change the port to avoid conflicts. We recommend 4443 or 10443.
   • You do not need to create a certificate, but you can create a self-signed one if you need it.

3. Scroll to the bottom of the page, where there are two more fields to configure.

   

4. In Authentication/Portal Mapping, click Create New, select your user group and assign it the tunnel-access portal.

5. Click Apply.

Firewall policy

1. Go to Policy & Objects > Firewall Policy and create a new policy.

   

2. Configure it as follows:

   • Name: a name for the policy. It is the one you enter in the application in the Ironchip console and in the plugin.
   • Incoming Interface: SSL-VPN tunnel interface.
   • Outgoing Interface: the physical interface.
   • Source: all and, very important, the group you created.
   • Destination: all.
   • Service: ALL.

3. Click OK.

4. Set the Fortinet and RADIUS connection timeouts to 60 seconds so users have time to complete authentication. Open a Fortinet terminal with the icon in the upper right corner. This command gives the users of the associated group 60 seconds:

   config user group
   edit <PROTECTED_USER_GROUP_NAME>
   set authtimeout 60
   end

5. Do the same for the RADIUS connection:

   config system global
   set remoteauthtimeout 60
   end

6. Change the configuration so that Fortinet does not send more than one request when you authenticate:

   config user radius
   edit <RADIUS_SERVER_NAME_IN_FORTIGATE>
   set timeout 60
   end

Application in Ironchip

Creating the Fortinet application in the Ironchip admin consolePlay video

Verify with FortiClient

Both the NPS server and Fortinet must be running when you test.

1. In FortiClient, select REMOTE ACCESS.

   

2. In the next window, select Configure VPN.

   

3. Enter the VPN details. Use the same user identification pattern that you set in the group and in the application in the Ironchip console. Click Save.

   

4. The next screen shows the connection name and the username. Enter the password and click Connect. If the computer firewall blocks the connection, create a rule that allows FortiClient to connect to the VPN IP and port instead of disabling the firewall.

   

5. A security alert appears. Read it and click Yes.

   

6. The connection process continues. You receive a message to authorize access from the Ironchip app. When you accept it, the connection completes.

7. When the connection is established, a window with a brief description appears.

   

Demo: Fortinet VPN access with IronchipPlay video

IPsec with SAML

Protect a remote access IPsec VPN tunnel (dial-up, IKEv2) on FortiGate with SAML authentication through Ironchip.

Requirements

• Administrative access to the FortiGate GUI and CLI.
• An administrator account in the Ironchip console with permissions to create SAML applications.
• FortiClient VPN installed on the client computers, with SSO/SAML support for IPsec.
• A remote access IPsec VPN (IKEv2).

Enable the global SAML port

From the Fortinet CLI, run:

config system global
    set auth-ike-saml-port 1001
end

Configure the SAML application

Configure SAML SSO in Fortinet and in Ironchip.

1. In FortiGate, go to User & Authentication > Single Sign-On and click Create New.

   

2. Enter a name for the configuration, the IP or DNS name of the VPN together with the SAML port you configured earlier, and the certificate you use in the VPN.

   

3. The next window asks for the identity provider (IdP) metadata, in this case Ironchip. To get it, go to the Ironchip admin console > Applications > New application > SAML.

   

   

4. When you create the application, it asks for a name. Use a descriptive one, because it appears later on the users’ authenticator devices.

   

5. Go to the Identity Provider (IdP) section and copy this data:

   • IdP Entity ID or Issuer
   • Single Sign On Service (URL)
   • Signing X.509 Certificate. You must import this certificate into Fortinet.

   

6. Paste the data into the Fortinet configuration:

   • IdP Entity ID or Issuer in Entity ID.
   • Single Sign On Service in Assertion consumer service URL.
   • Single logout service URL: use the same URL as Assertion consumer service URL, but change sso to slo in the path.

7. Enter the attributes Fortinet asks for to authenticate users:

   • Attribute used to identify users: urn:oid:0.9.2342.19200300.100.1.1
   • Attribute used to identify groups: urn:oid:1.3.6.1.4.1.5923.1.1.1.1

   

8. Get the Fortinet metadata to import it into Ironchip. Open the Fortinet global CLI and run:

   diag vpn ssl saml-metadata "<SAML NAME HERE>"

9. Copy the output. In the application you created in the Ironchip admin console, open the Service Provider (SP) section, select Text in SP Metadata, paste the output and click Import.

   

10. Click Add to finish creating the application in Ironchip.

Create the user group

Assign this SAML configuration to a group so you can later associate it with the firewall policies.

Enable EAP on the phase 1 interface

Edit the phase 1 interface to replace PSK with EAP against the Ironchip user group:

config vpn ipsec phase1-interface
    edit IPSEC-DIALUP
        set eap enable
        set eap-identity send-request
        set authusrgrp SAML-Group
end

Note

To apply authentication to several groups instead of just one, leave authusrgrp with empty quotes: set authusrgrp "".