Refer to the exhibits. Examine the FortiGate RSSO configuration shown in the exhibit. FortiGate is set up to use RSSO for user authentication. It is currently receiving RADIUS accounting messages…

Question

Exhibit

Options

• ARADIUS Attribute Value in the RSSO group must match the Class attribute
• BRSSO user groups should be assigned to all firewall policies.
• CDevice detection and Security Fabric Connection should be enabled on port3
• DRSSO agent's sso-attribute must be set to Class
• Ersso-endpoint-attribute must be set to User-Name

• A
  58% (28)
• B
  29% (14)
• C
  13% (6)

Explanation

The problem states: FortiGate receivesRADIUS accounting messagesonport3. User-Nameattribute contains the username. Classattribute contains the group membership. Goal: authenticate users through RSSO and map them to the correct user groups. To achieve this, three critical components must be configured: This is mandatory because: RSSO user groups on FortiGate match users based onthe value inside the RADIUS attribute(usually Class). For group assignment to work, FortiGate must compare: RSSO User Group RADIUS Class Attribute Value This isexactly how FortiGate maps RSSO users to groups. Thesso-attributedefineswhich RADIUS attribute contains the group information. Because group membership is carried in: You must configure: config user radius set sso-attribute Class This tells FortiGate: "Use the Class attribute to derive user group membership." This identifieswhich RADIUS attributecarries the actualusername. In this scenario: RADIUS accounting messages contain the username inUser-Name. So the correct setting is: config user radius set rsso-endpoint-attribute User-Name This ensures the RSSO user object uses the correct username.

No community discussion yet for this question.