FortiGate User Identification | NGFW

## Overview This video demonstrates FortiGate's user identification feature in next-generation firewalls (NGFW) and covers both agentless and agent-based deployment configurations. The feature enables the firewall to map network traffic to specific users by consolidating user and group information from multiple sources, with all data available in the FortiGate dashboard's User tab.

## Information Sources User information and IP mappings are pulled from: - Active Directory - RADIUS - Syslog - Exchange - eDirectory - Citrix Terminal Server

## Configuration Methods Two primary approaches are detailed:

**Agentless Configuration (FSSO Polling)**: Fortinet Single Sign-On periodically polls Active Directory at fixed intervals to retrieve user information. Administrators define an LDAP server as the source and select specific Active Directory groups from which to pull user information.

**Agent-Based Configuration**: A collector agent is deployed on a server within the domain controller's network. The transcript mentions using 4D Authenticator as an example collector agent. This approach provides enhanced functionality, enabling the collection of user mapping information from additional sources including syslog servers, Citrix Terminal Servers, and Exchange servers.

## Implementation & Usage Once the fabric connectors for identity are configured, administrators use the User Authentication tab to define user groups. These groups can be incorporated into security policies to control user access. All traffic traversing the FortiGate is mapped to specific users and can be viewed in the logs.

## Practical Demonstration The video includes a live demo showing: - A test user (Ron Smith) logged into a desktop behind the FortiGate - User web traffic to allowed sites (YouTube, Yahoo) appearing in the Forward Traffic Logs with username mapping - Blocked traffic (poker.com) recorded in web filtering logs with the associated username

All user activity is accessible through the Log and Report section, where the Forward Traffic Logs display all traffic with associated usernames, enabling granular visibility into who accessed what resources through the firewall.

## Key Benefits User identification enables security policies and access controls based on user identity rather than IP addresses alone, and provides detailed audit trails linking specific network activity to individual users.