Certificate–based authentication

This section provides an overview of how the FortiGate unit verifies the identities of administrators, SSL VPN

users, or IPsec VPN peers using X.509 security certificates. The following topics are included in this section:

• What is a security certificate?
• Certificates overview
• Managing X.509 certificates
• Configuring certificate-based authentication
• Example — Generate a CSR on the FortiGate unit
• Example — Generate and Import CA certificate with private key pair on OpenSSL
• Example — Generate an SSL certificate in OpenSSL

 

What is a security certificate?

A security certificate is a small text file that is part of a third-party generated public key infrastructure (PKI) to help guarantee the identity of both the user logging on and the web site they where they are logging in.

A certificate includes identifying information such as the company and location information for the web site, as well as the third-party company name, the expiry date of the certificate, and the public key.

FortiGate units use X.509 certificates to authenticate single sign-on (SSO) for users. The X.509 standard has been in use since before 2000, but has gained popularity with the Internet’s increased popularity. X.509 v3 is defined in RFC 5280 and specifies standard formats for public key certificates, certificate revocation lists, and a certification path validation algorithm. The unused earlier X.509 version 1 was defined in RFC 1422.

The main difference between X.509 and PGP certificates is that where in PGP anyone can sign a certificate, for X.509 only a trusted authority can sign certificates. This limits the source of certificates to well known and trustworthy sources. Where PGP is well suited for one-to-one communications, the X.509 infrastructure is intended to be used in many different situations including one-to-many communications. Some common filename extensions for X.509 certificates are listed below.

 

Common certificate filename extensions

 

Filetype	Format name	Description
.pem	Privacy Enhanced Mail (PEM)	Base64 encoded DER certificate, that uses: “—–BEGIN CERTIFICATE—–” and “—–END CERTIFICATE—–”

 

.cer

.crt

.der

Security CERtificate

Usually binary DER form, but Base64-encoded cer- tificates are common too.

.p7b

.p7c

Structure without data, just certificates or CRLs.

PKCS#7 is a standard for signing or encrypting (offi- cially called “enveloping”) data.

.p12          PKCS#12                                                      May contain certificate(s) (public) and private keys

(password protected).

.pfx           personal information exchange (PFX)          Older format. Came before PKCS#12. Usually today data is in PKCS#12 format.

 

 

Certificates overview

Certificates play a major role in authentication of clients connecting to network services via HTTPS, both for administrators and SSL VPN users. Certificate authentication is optional for IPsec VPN peers.

• Certificates and protocols
• IPsec VPNs and certificates
• Certificate types on the FortiGate unit

 

Certificates and protocols

There are a number of protocols that are commonly used with certificates including SSL and HTTPS, and other certificate-related protocols.

 

SSL and HTTPS

The secure HTTP (HTTPS) protocol uses SSL. Certificates are an integral part of SSL. When a web browser connects to the FortiGate unit via HTTPS, a certificate is used to verify the FortiGate unit’s identity to the client. Optionally, the FortiGate unit can require the client to authenticate itself in return.

By default, the FortiGate unit uses a self-signed security certificate to authenticate itself to HTTPS clients. When the certificate is offered, the client browser displays two security messages.

• The first message prompts users to accept and optionally install the FortiGate unit’s self-signed security certificate.

If the user does not accept the certificate, the FortiGate unit refuses the connection. When the user accepts the certificate, the FortiGate login page is displayed, and the credentials entered by the user are encrypted before they are sent to the FortiGate unit. If the user chooses to install the certificate, the prompt is not displayed again.

• Just before the FortiGate login page is displayed, a second message informs users that the FortiGate certificate distinguished name differs from the original request. This message is displayed because the FortiGate unit redirects the connection (away from the distinguished name recorded in the self-signed certificate) and can be ignored.

Optionally, you can install an X.509 server certificate issued by a certificate authority (CA) on the FortiGate unit. You can then configure the FortiGate unit to identify itself using the server certificate instead of the self-signed certificate.

For more information, see the FortiOS Handbook SSL VPN guide.

After successful certificate authentication, communication between the client browser and the FortiGate unit is encrypted using SSL over the HTTPS link.

 

Certificate–related protocols

There are multiple protocols that are required for handling certificates. These include the Online Certificate Status Protocol (OCSP), Secure Certificate Enrollment Protocol (SCEP), and Server-based Certificate Validation Protocol (SCVP).

 

Online Certificate Status Protocol

Online Certificate Status Protocol (OCSP) allows the verification of X.509 certificate expiration dates. This is important to prevent hackers from changing the expiry date on an old certificate to a future date.

Normally certificate revocation lists (CRLs) are used, but OCSP is an alternate method available. However a CRL is a public list, and some companies may want to avoid the public exposure of their certificate structure even if it is only invalid certificates.

The OSCP check on the certificate’s revocation status is typically carried out over HTTP with a request-response format. The authority responding can reply with a status of good, revoked, or unknown for the certificate in question.

 

Secure Certificate Enrollment Protocol

Secure Certificate Enrollment Protocol (SCEP) is an automated method of signing up for certificates. Typically this involves generating a request you send directly to the SCEP service, instead of generating a file request that may or may not be signed locally.

 

Server–based Certificate Validation Protocol

Server-based Certificate Validation Protocol (SCVP) is used to trace a certificate back to a valid root level certificate. This ensures that each step along the path is valid and trustworthy.

Customizing captive portal pages

These pages are defined in replacement messages. Defaults are provided. In the web-based manager, you can modify the default messages in the SSID configuration by selecting Customize Portal Messages. Each SSID can have its own unique portal content.

The captive portal contains the following default web pages:

• Login page—requests user credentials

Typical modifications for this page would be to change the logo and modify some of the text.

You can change any text that is not part of the HTML code nor a special tag enclosed in double percent (%) characters.

There is an exception to this rule. The line “Please enter your credentials to continue” is provided by the

%%QUESTION%% tag. You can replace this tag with text of your choice. Except for this item, you should not remove any tags because they may carry information that the FortiGate unit needs.

• Login failed page—reports that the entered credentials were incorrect and enables the user to try again.

The Login failed page is similar to the Login page. It even contains the same login form. You can change any text that is not part of the HTML code nor a special tag enclosed in double percent (%) characters.

There is an exception to this rule. The line “Firewall authentication failed. Please try again.” is provided by the %%FAILED_MESSAGE%% tag. You can replace this tag with text of your choice. Except for this item, you should not remove any tags because they may carry information that the FortiGate unit needs.

• Disclaimer page—is a statement of the legal responsibilities of the user and the host organization to which the user must agree before proceeding.(WiFi or SSL VPN only)
• Declined disclaimer page—is displayed if the user does not agree to the statement on the Disclaimer page. Access is denied until the user agrees to the disclaimer.

 

Changing images in portal messages

You can replace the default Fortinet logo with your organization’s logo. First, import the logo file into the FortiGate unit and then modify the Login page code to reference your file.

 

To import a logo file:

1. Go to System > Config > Replacement Messages and select Manage Images.

2. Select Create New.

3. Enter a Name for the logo and select the appropriate Content Type.

The file must not exceed 24 Kilo bytes.

4. Select Browse, find your logo file and then select Open.

5. Select OK.

 

To specify the new logo in the replacement message:

1. Go to System > Network > Interfaces and edit the interface.

The Security Mode must be Captive Portal.

2. Select the portal message to edit.

• In SSL VPN or WiFi interfaces, in Customize Portal Messages click the link to the portal messages that you want to edit.
• In other interfaces, make sure that Customize Portal Messages is selected, select the adjacent Edit icon, then select the message that you want to edit.

3. In the HTML message text, find the %%IMAGE tag.

By default it specifies the Fortinet logo: %%IMAGE:logo_fw_auth%%

4. Change the image name to the one you provided for your logo.

The tag should now read, for example, %%IMAGE:mylogo%%

5. Select Save.

6. Select OK.

 

Modifying text in portal messages

Generally, you can change any text that is not part of the HTML code nor a special tag enclosed in double percent (%) characters. You should not remove any tags because they may carry information that the FortiGate unit needs. See the preceding section for any exceptions to this rule for particular pages.

 

To modify portal page text

1. Go to System > Network > Interfaces and edit the interface.

The SSID Security Mode must be Captive Portal.

2. Select the portal message to edit.

• In SSL VPN or WiFi interfaces, in Customize Portal Messages click the link to the portal messages that you want to edit.
• In other interfaces, make sure that Customize Portal Messages is selected, select the adjacent Edit icon, then select the message that you want to edit.

3. Edit the HTML message text, then select Save.

4. Select OK.

 

Configuring a captive portal

Captive portals are configured on network interfaces. On a physical (wired) network interface, you edit the interface configuration in System > Network > Interfaces and set Security Mode to Captive Portal. A WiFi interface does not exist until the WiFi SSID is created. You can configure a WiFi captive portal at the time that you create the SSID. Afterwards, the captive portal settings will also be available by editing the WiFi network interface in System > Network > Interfaces.

 

To configure a wired Captive Portal – web-based manager:

1. Go to System > Network > Interfaces and edit the interface to which the users connect.

2. In Security Mode select Captive Portal.

3. Enter

 

Authentication Portal                Local – portal hosted on the FortiGate unit.

Remote – enter FQDN or IP address of external portal.

User Groups                               Select permitted user groups or select Use Groups from Policies, which permits the groups specified in the security policy.

Use Groups from Policies is not available in WiFi captive portals.

Exempt List                                Select exempt lists whose members will not be subject to captive portal authentication.

Customize Portal

Messages

Enable, then select Edit. See Customizing captive portal pages on page 516.

4. Select OK.

 

To configure a WiFi Captive Portal – web-based manager:

1. Go to WiFi Controller > WiFi Network > SSID and create your SSID.

If the SSID already exists, you can edit the SSID or you can edit the WiFi interface in System > Network > Interfaces.

2. In Security Mode, select Captive Portal.

3. Enter

 

Portal Type                                 The portal can provide authentication and/or disclaimer, or perform user email address collection. See Introduction to Captive Portals on page 514.

Authentication Portal                Local – portal hosted on the FortiGate unit.

Remote – enter FQDN or IP address of external portal.

User Groups                               Select permitted user groups.

Exempt List                                Select exempt lists whose members will not be subject to captive portal authentication.

Customize Portal Messages     Click the link of the portal page that you want to modify. See “Captive portals” on page 516.

4. Select OK.

 

Exemption from the captive portal

A captive portal requires all users on the interface to authenticate. But some devices are not able to authenticate. You can create an exemption list of these devices. For example, a printer might need to access the Internet for firmware upgrades. Using the CLI, you can create an exemption list to exempt all printers from authentication.

config user security-exempt-list edit r_exempt

config rule edit 1

set devices printer end

end

Captive portals

A captive portal is a convenient way to authenticate web users on wired or WiFi networks. This section describes:

• Introduction to Captive Portals
• Configuring a captive portal
• Customizing captive portal pages

 

Introduction to Captive Portals

You can authenticate your users on a web page that requests the user’s name and password. Until the user authenticates successfully, the authentication page is returned in response to any HTTP request. This is called a captive portal.

After successful authentication, the user accesses the requested URL and can access other web resources, as permitted by security policies. Optionally, the captive portal itself can allow web access to only the members of specified user group.

The captive portal can be hosted on the FortiGate unit or on an external authentication server. You can configure captive portal authentication on any network interface, including WiFi and VLAN interfaces.

When a captive portal is configured on a WiFi interface, the access point initially appears open. The wireless client can connect to the access point with no security credentials, but sees only the captive portal authentication page.

 

WiFi captive portal types:

• Authentication — until the user enters valid credentials, no communication beyond the AP is permitted.
• Disclaimer + Authentication — immediately after successful authentication, the portal presents the disclaimer page—an acceptable use policy or other legal statement—to which the user must agree before proceeding.
• Disclaimer Only — the portal presents the disclaimer page—an acceptable use policy or other legal statement—to which the user must agree before proceeding. The authentication page is not presented.
• Email Collection — the portal presents a page requesting the user’s email address, for the purpose of contacting the person in future. This is often used by businesses who provide free WiFi access to their customers. The authentication page is not presented.

Configuring authenticated access

When you have configured authentication servers, users, and user groups, you are ready to configure security policies and certain types of VPNs to require user authentication.

This section describes:

• Authentication timeout
• Password policy
• Authentication protocols
• Authentication in Captive Portals
• Authentication in security policies
• VPN authentication

 

Authentication timeout

An important feature of the security provided by authentication is that it is temporary—a user must re- authenticate after logging out. Also if a user is logged on and authenticated for an extended period of time, it is a good policy to have them re-authenticate at set periods. This ensures a user’s session is cannot be spoofed and used maliciously for extended periods of time — re-authentication will cut any spoof attempts short. Shorter timeout values are more secure.

 

Security authentication timeout

You set the security user authentication timeout to control how long an authenticated connection can be idle before the user must authenticate again. The maximum timeout is 1440 minutes (24 hours).

To set the security authentication timeout – web-based manager:

1. Go to User & Device > Authentication > Settings.

2. Enter the Authentication Timeout value in minutes.

The default authentication timeout is 5 minutes.

3. Select Apply.

 

SSL VPN authentication timeout

You set the SSL VPN user authentication timeout (Idle Timeout) to control how long an authenticated connection can be idle before the user must authenticate again. The maximum timeout is 259 200 seconds. The default timeout is 300 seconds.

 

To set the SSL VPN authentication timeout – web-based manager:

1. Go to VPN > SSL > Settings.

2. Under Idle Logout, make sure that Logout users when inactive for specified period is enabled and enter the Inactive For value (seconds).

3. Select Apply.