FortiGate is configured for firewall authentication. When attempting to access an external website, the user is not presented with a login prompt…

Firewall authentication policies require users to be identified before allowing traffic. This identification can be active or passive. Active authentication intercepts the user's session and presents a captive portal (login prompt). Passive authentication, such as Fortinet Single Sign-On (FSSO), identifies users transparently by monitoring authentication events on an external server (e.g., a Windows Active Directory domain controller). If a user has already been identified via a passive method, the FortiGate has a record of their authenticated session and will not challenge them with a login prompt when their traffic matches the policy.

A. No matching user account exists for this user.

This would cause an authentication failure after the user submits credentials at a login prompt, not prevent the prompt from appearing in the first place.

B. The user is using a guest account profile.

A guest account is a type of user profile. If the policy requires authentication, the guest user would still be presented with a login prompt to authenticate.

D. The user is using a super admin account.

A super admin account is for device administration (managing the FortiGate). It is not used for authenticating user traffic passing through firewall policies.

1. Fortinet FortiOS 7.0.1 Administration Guide:

Page 1038

Section: Authentication methods: "Passive authentication: The user does not have to enter their credentials to be authenticated. Instead

the FortiGate unit gets the user's information from a domain controller or other external authentication server." This directly explains why a user would not see a login prompt.

Page 1038

Section: Authentication methods: "Active authentication: The user must enter their credentials to be authenticated. The FortiGate unit can display a login page to get the user's credentials." This describes the alternative scenario where a prompt would appear.

2. Fortinet FortiOS 7.0.0 Cookbook:

Page 1

Section: FSSO with basic Active Directory integration: "Fortinet Single Sign-On (FSSO) allows your users to authenticate seamlessly to the FortiGate without having to enter their login credentials a second time." This confirms the transparent nature of passive authentication.

Page 1

Section: FSSO with basic Active Directory integration: "Users log in to their Windows AD domain as they normally do

and are not prompted for a password to access Internet resources." This provides a specific example that matches the question's scenario.