FortiGate is configured for firewall authentication. When attempting to access an external website, the user is not presented with a login prompt. What is the most likely reason for this situation?

Firewall authentication policies require users to be identified before allowing traffic. This identification can be active or passive. Active authentication intercepts the user's session and presents a captive portal (login prompt). Passive authentication, such as Fortinet Single Sign-On (FSSO), identifies users transparently by monitoring authentication events on an external server (e.g., a Windows Active Directory domain controller). If a user has already been identified via a passive method, the FortiGate has a record of their authenticated session and will not challenge them with a login prompt when their traffic matches the policy.

A. No matching user account exists for this user. This would cause an authentication failure after the user submits credentials at a login prompt, not prevent the prompt from appearing in the first place.
B. The user is using a guest account profile. A guest account is a type of user profile. If the policy requires authentication, the guest user would still be presented with a login prompt to authenticate.
D. The user is using a super admin account. A super admin account is for device administration (managing the FortiGate). It is not used for authenticating user traffic passing through firewall policies.

1. Fortinet FortiOS 7.0.1 Administration Guide:

Page 1038

Section: Authentication methods: "Passive authentication: The user does not have to enter their credentials to be authenticated. Instead

the FortiGate unit gets the user's information from a domain controller or other external authentication server." This directly explains why a user would not see a login prompt.

Page 1038

Section: Authentication methods: "Active authentication: The user must enter their credentials to be authenticated. The FortiGate unit can display a login page to get the user's credentials." This describes the alternative scenario where a prompt would appear.

2. Fortinet FortiOS 7.0.0 Cookbook:

Page 1

Section: FSSO with basic Active Directory integration: "Fortinet Single Sign-On (FSSO) allows your users to authenticate seamlessly to the FortiGate without having to enter their login credentials a second time." This confirms the transparent nature of passive authentication.

Page 1

Section: FSSO with basic Active Directory integration: "Users log in to their Windows AD domain as they normally do

and are not prompted for a password to access Internet resources." This provides a specific example that matches the question's scenario.