Hi.<br><br>We have this setup today.<br><br>Fortigate FW - running SSL vpn portal, users are authenticated towards a Cisco ACS radius server.<br><br>We only use one vdom ( virtual firewall) but we have a plan to create a portal to every co companies.<br>
So I created two new vdom on the fortigate called, : ompa and tampa and gave them ssl  portal. - <a href="https://ompa.corp.com">https://ompa.corp.com</a> and <a href="https://tampa.corp.com">https://tampa.corp.com</a><br>
<br>Both of them use the Cisco ACS to authenticate users, so at this point the same username can login to both SSL portals, this is no good :-(<br><br>Then I tried to add a fortigate VSA to the Cisco ACS server, so when user <a href="mailto:pet@ompa.corp.com">pet@ompa.corp.com</a> login to <a href="https://tampa.corp.com">https://tampa.corp.com</a> , ACS server retun &quot;Fortinet-Vdom-Name = ompa&quot; to the fortigate, and I was looking forward to see the ompa portal but i got tampa. So Fortigate just ignore the VSA from the ACS .<br>
<br>Fortigate radius impementation seems to be braindead :-(<br><br>I did some sniffing, and it seems that *fortigate* return Fortinet-Vdom-Name= ompa when you use <a href="https://ompa.corp.com">https://ompa.corp.com</a>, and Fortinet-Vdom-Name= tampa when you use <a href="https://tampa.corp.com">https://tampa.corp.com</a>.<br>
<br>So we need to have some checking on the radiusserver, to verify user realm vs what fortigate retuns. Cisco ACS server doesn&#39;t support this type of checking.<br><br>Now I have installed a freeradius and it does proxy towards the ACS from Fortigate FW, but I need some help to configure this checking, could rlm do this stuff?<br>
<br>if user <a href="mailto:pet@ompa.corp.com">pet@ompa.corp.com</a> login to tampa, and Fortigate return Fortinet-Vdom-Name= tampa it should *not* get access, but if it retun Fortinet-Vdom-Name= ompa it should get access.<br>
<br><br>Ole<br>