Agentless NTLM authentication for web proxy

In FortiOS, agentless Windows NT LAN Manager (NTLM) authentication includes support for the following items:

• Multiple servers
• Individual users

You can use multiple domain controller servers for the agentless NTLM. They can be used for load balancing and high service stability.

You can also use user-based matching in groups for Kerberos and agentless NTLM. In these scenarios, FortiOS matches the user's group information from an LDAP server.

To support multiple domain controllers for agentless NTLM using the CLI:

1. Configure an LDAP server:

   config user ldap

   edit "ldap-kerberos"

   set server "172.18.62.177"

   set cnid "cn"

   set dn "dc=fortinetqa,dc=local"

   set type regular

   set username "CN=root,CN=Users,DC=fortinetqa,DC=local"

   set password **********

   next

   end

2. Configure multiple domain controllers:

   config user domain-controller

   edit "dc1"

   set ip-address 172.18.62.177

   config extra-server

   edit 1

   set ip-address 172.18.62.220

   next

   end

   set ldap-server "ldap-kerberos"

   next

   end

3. Create an authentication scheme and rule:

   config authentication scheme

   edit "au-ntlm"

   set method ntlm

   set domain-controller "dc1"

   next

   end

   config authentication rule

   edit "ru-ntlm"

   set srcaddr "all"

   set ip-based disable

   set active-auth-method "au-ntlm"

   next

   end

4. In the proxy policy, append the user group for authorization:

   config firewall proxy-policy

   edit 1

   set proxy explicit-web

   set dstintf "port1"

   set srcaddr "all"

   set dstaddr "all"

   set service "web"

   set action accept

   set schedule "always"

   set groups "ldap-group"

   set utm-status enable

   set av-profile "av"

   set ssl-ssh-profile "deep-custom"

   next

   end

   This configuration uses a round-robin method. When the first user logs in, the FortiGate sends the authentication request to the first domain controller. Later when another user logs in, the FortiGate sends the authentication request to another domain controller.

5. Verify the behavior after the user successfully logs in:

   # diagnose wad user list

   ID: 1825, IP: 10.1.100.71, VDOM: vdom1

   user name : test1

   duration : 497

   auth_type : Session

   auth_method : NTLM

   pol_id : 1 g_id : 5

   user_based : 0 e

   xpire : 103

   LAN:

   bytes_in=2167 bytes_out=7657

   WAN:

   bytes_in=3718 bytes_out=270

To support individual users for agentless NTLM using the CLI:

1. Configure an LDAP server:

   config user ldap

   edit "ldap-kerberos"

   set server "172.18.62.177"

   set cnid "cn"

   set dn "dc=fortinetqa,dc=local"

   set type regular

   set username "CN=root,CN=Users,DC=fortinetqa,DC=local"

   set password **********

   next

   end

2. Configure the user group and allow user-based matching:

   config user group

   edit "ldap-group"

   set member "ldap" "ldap-kerberos"

   config match

   edit 1

   set server-name "ldap-kerberos"

   set group-name "test1"

   next

   end

   next

   end

3. Create an authentication scheme and rule:

   config authentication scheme

   edit "au-ntlm"

   set method ntlm

   set domain-controller "dc1"

   next

   end

   config authentication rule

   edit "ru-ntlm"

   set srcaddr "all"

   set ip-based disable

   set active-auth-method "au-ntlm"

   next

   end

4. In the proxy policy, append the user group for authorization:

   config firewall proxy-policy

   edit 1

   set proxy explicit-web

   set dstintf "port1"

   set srcaddr "all"

   set dstaddr "all"

   set service "web"

   set action accept

   set schedule "always"

   set groups "ldap-group"

   set utm-status enable

   set av-profile "av"

   set ssl-ssh-profile "deep-custom"

   next

   end

   This implementation lets you configure a single user instead of a whole group. The FortiGate will now allow the user named test1.

   To verify the configuration using the CLI:

   diagnose wad user list

   ID: 1827, IP: 10.1.15.25, VDOM: vdom1

   user name : test1

   duration : 161

   auth_type : Session

   auth_method : NTLM

   pol_id : 1

   g_id : 5

   user_based : 0

   expire : 439

   LAN:

   bytes_in=1309 bytes_out=4410

   WAN:

   bytes_in=2145 bytes_out=544