Configure optional settings
Fortinet supports tw optional settings: Client IP Reporting and Groups response.
Topics:
Before you begin
- Ensure that you have the common UDP Port and Secret key values available
Configure Client IP Reporting
To configure Okta to be able to parse, report on and eventually enforce policy based off of the source client IP Address you need to configure the Fortinet Fortigate (RADIUS) App in Okta as follows:
Enter the following settings in Advanced RADIUS Settings found on the Sign On tab for the RADIUS app in your Okta Admin Console, as shown below.
- Client IP: Check Report client IP.
- RADIUS End User IP Attributes: 31 Calling-Station-Id
Configure Groups Response
The Fortinet appliance does not receive groups using the standard Attribute Value Pairs (AVP) of 11 (Filter-Id) and 25 (Class). Instead it relies on Vendor Specific Attributes.
To configure the app to send RADIUS Group information in vendor specific attributes:
- In Okta, navigate to Applications > Applications.
- Open the application by clicking its name.
Tip
You can narrow the set of applications displayed using the Search field.
- Select the sign on tab.
- Scroll to the Advanced RADIUS Settings section and click Edit.
- In the GROUPS RESPONSE section:
- Check include groups in RADIUS response.
- In the RADIUS attributes sub section, specify the following:
Field
Value
Comment
RADIUS attribute
26-Vendor specific.
Must be 26-Vendor specific
vendor specific ID
Enter one of :
Cisco - ASA-Group-Policy (3076)Citrix-Group-Names (3845)
Fortinet-Group-Name(12356)
PaloAlto-User-Group(25461)
Enter the associated numeric vendor id.
For example, for Cisco enter 3076.
Unlisted - The unique vendor code or ID. For example Cisco refers to this value RADIUS Vendor ID, Citrix uses Vendor code.Attribute ID
Cisco - ASA-Group-Policy (25)
Citrix-Group-Names (16)
Fortinet-Group-Name(1)
PaloAlto-User-Group(5)
Enter the associated numeric attribute id. For example, for Cisco enter 25.
Unlisted - The unique vendor specific code associated with group policy. For example, for Cisco uses value 25 to indicate Group-Policy.Important
Vendor specific ID and Attribute ID are string fields.
Caution
- The maximum group membership value length is 247 bytes. In situations where length of group memberships or where any group names length exceeds the maximum size truncation will occur and partial values returned.
- In such situations Okta suggests configuring the response as a set of Repeated Attributes as opposed to a single delimited list.
- The maximum group membership value length is 247 bytes. In situations where length of group memberships or where any group names length exceeds the maximum size truncation will occur and partial values returned.
- Click Save.