Authentication of VPN users from CISCO ISE

[s.gupta]

Hi all,

Can we authenticate Fortigate VPN users from Cisco ISE & can we do posture check on them? If yes can anyone help me in creating Network Device profile for Fotigate Firewall on cisco ISE & how will the redirection work for users to Client Provisioning portal on ISE.

Sooner reply will be appreciated..

Regards

Saurabh Gupta

[Jason Kunst]

The only known network devices to support posture AFAIK are Cisco vpn concentrator (such as the ASA) that support COA. Change of authorization allows a session to switch states and update ACLs vlans or tags. It also requires a URL redirection. If running ise 2.2+ then that might not be required .

This allows a device to come in and be evaluated before given full access.

Does fortigate have support of these functions?

[maf_1]

hi,

i believe fortigate does support CoA as it is RFC 5176. please refer to link below. 
FortiOS Supported RFCs (fortinetweb.s3.amazonaws.com)

I too am looking to do the same. Our scenario is User-> Fortigate -> ISE( AD integrated ) -> FortiAuthenticator ( AD integrated, Using for MFA). We have done plain authentication but need clues to implement posture.

[maf_1]

As for URL redirect, i think that could work since Fortinet does push portals. But would be great to know how ISE could be setup for such a thing.