Chapter 3 Authentication for FortiOS 5.0 : Examples and Troubleshooting : RADIUS SSO example : Configuring FortiGate regular and RADIUS SSO security policies
  
Configuring FortiGate regular and RADIUS SSO security policies
With the RADIUS server and FortiGate interfaces configured, security policies can be configured. This includes both RADIUS SSO and regular policies, as well as addresses and address groups. All policies require NAT to be enabled.
Table 29: security policies needed for RADIUS SSO
Seq. No.
From -> To
Type
Schedule
Description
1
internal -> wan1
RADIUS SSO
business hours
Authenticate outgoing user traffic.
2
internal -> wan1
regular
always
Allow essential network services and VoIP.
3
dmz -> wan1
regular
always
Allow servers to access Internet.
4
internal -> dmz
regular
always
Allow users to access servers.
5
any -> any
deny
always
Implicit policy denying all traffic that hasn’t been matched
 
The RADIUS SSO policy must be placed at the top of the policy list so it is matched first. The only exception to this is if you have a policy to deny access to a list of banned users. In this case, that policy must go at the top so the RADIUS SSO does not mistakenly match a banned user or IP address.
This section includes:
• Schedules, address groups, and services groups
• Configuring regular security policies
• Configuring RADIUS SSO security policy