How do you implement user-based firewall policies in FortiGate?

How do you implement user-based firewall policies in FortiGate?

• A. Use identity-based policies that apply to users or groups via LDAP/RADIUS or FortiAuthenticator, allowing enforcement by user identity.
• B. Use IP-based policies only.
• C. User identity is not supported in FortiGate.
• D. Only firewall administrators can configure policies.

Answer: (A)

The key idea is to enforce firewall rules based on who the user is, not just where the traffic comes from. FortiGate can do this by using identity-based policies. You connect FortiGate to an identity source—LDAP or RADIUS from an internal directory, or FortiAuthenticator—to learn user identities and group memberships. Then you create firewall policies whose source is a user or a user group rather than an IP address. This lets you permit or deny traffic based on the actual user (or group) regardless of which device or location they’re coming from, which is especially valuable for VPN and roaming users. Why this is the best approach: tying rules to user identity provides consistent access control across dynamic environments and simplifies management since you can update access by group membership rather than reworking IP-based rules. IP-based policies are limited because they rely on fixed source IPs and don’t reflect who is using the device. Fortinet does support user identity, so that option isn’t accurate. The other statements don’t describe the mechanism for implementing user-based control and aren’t about how to enforce policies by user identity.

The key idea is to enforce firewall rules based on who the user is, not just where the traffic comes from. FortiGate can do this by using identity-based policies. You connect FortiGate to an identity source—LDAP or RADIUS from an internal directory, or FortiAuthenticator—to learn user identities and group memberships. Then you create firewall policies whose source is a user or a user group rather than an IP address. This lets you permit or deny traffic based on the actual user (or group) regardless of which device or location they’re coming from, which is especially valuable for VPN and roaming users.

Why this is the best approach: tying rules to user identity provides consistent access control across dynamic environments and simplifies management since you can update access by group membership rather than reworking IP-based rules.

IP-based policies are limited because they rely on fixed source IPs and don’t reflect who is using the device. Fortinet does support user identity, so that option isn’t accurate. The other statements don’t describe the mechanism for implementing user-based control and aren’t about how to enforce policies by user identity.