Cord Attribute

The Explorer

Ian H. Witten , ... Mark A. Hall , in Information Mining (Third Edition), 2011

String Conversion

A string attribute has an unspecified number of values. StringToNominal converts information technology to nominal with a set up number of values. You should ensure that all string values that volition appear in potential examination data are represented in the dataset. NominalToString converts the other manner.

StringToWordVector produces numeric attributes that correspond the frequency of words in the value of a string aspect. The prepare of words—that is, the new aspect gear up—is determined from the total gear up of values in the string attribute. The new attributes can exist named with a user-determined prefix to keep attributes derived from different string attributes singled-out.

There are many options that touch tokenization. Words can exist formed from contiguous alphabetic sequences or separated by a given set of delimiter characters. In the latter case, they can be further split into northward-grams (with user-supplied minimum and maximum length), or they tin can be processed by a stemming algorithm. They can exist converted to lowercase before being added to the dictionary, or all words on a supplied list of stopwords tin exist ignored. Words that are non amidst the top k words ranked past frequency tin be discarded (slightly more than than k words volition be retained if there are ties at the 1000thursday position). If a class aspect has been assigned, the top thou words for each class volition be kept (this tin be turned off past the user). The value of each give-and-take attribute reflects its presence or absence in the string, but this can be inverse. A count of the number of times the word appears in the string can exist used instead. Word frequencies tin be normalized to requite each certificate's attribute vector the same Euclidean length—the length called is not 1 to avoid the very small numbers that would entail, but is the average length of all documents that announced as values of the original cord attribute. Alternatively, the frequencies fij for word i in document j tin be transformed using log (1 + fij ) or the TF × IDF mensurate (see Section 7.three, folio 329).

ChangeDateFormat alters the formatting string that is used to parse date attributes. Whatsoever format supported by Java's SimpleDateFormat course can be specified.

Read total chapter

URL:

https://www.sciencedirect.com/science/commodity/pii/B9780123748560000110

Input

Ian H. Witten , ... Christopher J. Pal , in Data Mining (Fourth Edition), 2017

Attribute Types

The ARFF format accommodates the two bones data types: nominal and numeric. String attributes and date attributes are effectively nominal and numeric, respectively, although before they are used strings are often converted into a numeric form such as a word vector. Relation-valued attributes comprise separate sets of instances that accept basic attributes, such equally numeric and nominal ones. How the ii basic types are interpreted depends on the learning scheme existence used. For example, many schemes treat numeric attributes as ordinal scales and only use less-than and greater-than comparisons between the values. However, some treat them as ratio scales and utilise altitude calculations. You need to understand how machine learning schemes work earlier using them for information mining.

If a learning scheme treats numeric attributes equally though they are measured on ratio scales, the question of normalization arises. Attributes are oft normalized to lie in a stock-still range—unremarkably from nada to ane—by dividing all values by the maximum value encountered or past subtracting the minimum value and dividing past the range between the maximum and minimum values. Another normalization technique is to calculate the statistical mean and standard difference of the attribute values, subtract the hateful from each value, and split the result by the standard deviation. This procedure is called standardizing a statistical variable and results in a set of values whose mean is cipher and standard deviation is one.

Some learning schemes—e.g., instance-based and regression methods—deal only with ratio scales because they summate the "distance" between two instances based on the values of their attributes. If the actual scale is ordinal, a numeric distance function must be defined. 1 mode of doing this is to apply a two-level altitude: one if the two values are different and nada if they are the aforementioned. Any nominal quantity can be treated equally numeric past using this distance function. However, it is rather a crude technique and conceals the true degree of variation betwixt instances. Another possibility is to generate several synthetic binary attributes for each nominal attribute: we return to this in Department 7.iii when nosotros look at the utilise of trees for numeric prediction.

Sometimes there is a genuine mapping between nominal attributes and numeric scales. For example, postal Naught codes signal areas that could exist represented past geographical coordinates; the leading digits of telephone numbers may do so too, depending on where you live. The first two digits of a student'southward identification number may exist the year in which she first enrolled.

It is very mutual for applied datasets to comprise nominal values that are coded equally integers. For example, an integer identifier may be used as a code for an attribute such every bit role number, yet such integers are not intended for use in less-than or greater-than comparisons. If this is the case, information technology is important to specify that the attribute is nominal rather than numeric.

It is quite possible to treat an ordinal attribute as though it were nominal. Indeed, some machine learning schemes only deal with nominal elements. For example, in the contact lens problem the historic period attribute is treated as nominal, and the rules generated included these:

If historic period = young and astigmatic = no

and tear production charge per unit = normal

then recommendation = soft

If age = pre-presbyopic and astigmatic = no

and tear production rate = normal

then recommendation = soft

But in fact age, specified in this way, is really an ordinal attribute for which the following is true:

young < pre-presbyopic < presbyopic.

If it were treated as ordinal, the two rules could be collapsed into one:

If age ≤pre-presbyopic and astigmatic = no

and tear production rate = normal

then recommendation = soft

which is a more than meaty, and hence more satisfactory, style of saying the same affair.

Read full chapter

URL:

https://www.sciencedirect.com/science/article/pii/B9780128042915000027

Input

Ian H. Witten , ... Marker A. Hall , in Data Mining (Third Edition), 2011

Aspect Types

The ARFF format accommodates the two basic data types, nominal and numeric. Cord attributes and date attributes are effectively nominal and numeric, respectively, although before they are used, strings are often converted into a numeric form such every bit a give-and-take vector. Relation-valued attributes contain split up sets of instances that have basic attributes, such as numeric and nominal ones. How the two basic types are interpreted depends on the learning scheme being used. For instance, many schemes treat numeric attributes as ordinal scales and simply use less-than and greater-than comparisons between the values. However, some care for them as ratio scales and use altitude calculations. Yous demand to understand how machine learning schemes piece of work before using them for information mining.

If a learning scheme treats numeric attributes as though they are measured on ratio scales, the question of normalization arises. Attributes are often normalized to lie in a fixed range—usually from 0 to one—by dividing all of the values past the maximum value encountered or by subtracting the minimum value and dividing by the range between the maximum and minimum values. Some other normalization technique is to summate the statistical mean and the standard deviation of the attribute values, then subtract the mean from each value and divide the effect by the standard deviation. This process is called standardizing a statistical variable and results in a gear up of values whose mean is 0 and the standard deviation is 1.

Some learning schemes—for example, case-based and regression methods—deal merely with ratio scales considering they calculate the "altitude" between two instances based on the values of their attributes. If the actual scale is ordinal, a numeric distance office must be divers. One way of doing this is to use a two-level distance: 1 if the two values are different and 0 if they are the same. Any nominal quantity can be treated equally numeric past using this distance function. However, it is a rather crude technique and conceals the true degree of variation between instances. Another possibility is to generate several synthetic binary attributes for each nominal attribute: We return to this in Section vi.six when we look at the use of trees for numeric prediction.

Sometimes there is a 18-carat mapping between nominal quantities and numeric scales. For example, postal zippo codes betoken areas that could be represented by geographical coordinates; the leading digits of telephone numbers may do then as well, depending on where yous live. The first two digits of a student's identification number may be the year in which she first enrolled.

It is very common for applied datasets to comprise nominal values that are coded as integers. For example, an integer identifier may be used as a code for an aspect such equally function number, yet such integers are non intended for utilize in less-than or greater-than comparisons. If this is the case, it is of import to specify that the attribute is nominal rather than numeric.

It is quite possible to treat an ordinal quantity every bit though it were nominal. Indeed, some machine learning schemes only deal with nominal elements. For case, in the contact lens problem the age aspect is treated as nominal, and the rules generated included these:

If age = immature and astigmatic = no

 and tear product rate = normal

 then recommendation = soft

If historic period = pre-presbyopic and astigmatic = no

and tear production rate = normal

 then recommendation = soft

But in fact age, specified in this manner, is really an ordinal quantity for which the following is true:

immature < pre-presbyopic < presbyopic

If it were treated as ordinal, the two rules could be collapsed into one:

If historic period ≤ pre-presbyopic and astigmatic = no

 and tear production charge per unit = normal

 then recommendation = soft

which is a more than compact, and hence more than satisfactory, mode of saying the same thing.

Read total chapter

URL:

https://www.sciencedirect.com/science/article/pii/B978012374856000002X

Data Extraction

Daniel Linstedt , Michael Olschimke , in Edifice a Scalable Data Warehouse with Data Vault 2.0, 2016

11.iv Purpose of the Record Source

The record source has been added for debugging purposes only. Information technology can and should be used by the data warehousing team to trace where the row information came from. In order to attain this, the record source is a string attribute that provides a technical name of the source system, equally detailed as it is required. In most cases, data warehouse teams make up one's mind to utilise some hierarchical structure to signal not only the source organisation, but also the module or table name. If accessing a relational Microsoft SQL Server source, the record source should employ the following format:

For instance, the following record source would betoken a table from the CRM application, in the Cust schema:

Avoid using just the proper noun of the source organization considering following this approach tin be very helpful when tracing down errors. When analyzing the data warehouse due to a run-time mistake, either in development or product, it is helpful to take detailed data bachelor.

The record source is added to all tables in the staging surface area, the Raw Data Vault, the Business Vault and probably the information marts. Simply what if data from multiple sources is combined or aggregated? In this case, the record source is not clear anymore. The recommended exercise is to set the record source to the technical proper noun of the business dominion that generated the record. The technical proper noun tin can be found in the metadata of the data warehouse (refer to Affiliate 10, Metadata Management). If there is no business organization rule, the record source should be set to Arrangement. Examples include the ghost record in satellites (run into Affiliate 6, Avant-garde Data Vault Modeling) or whatsoever other arrangement-driven records.

Employ of record sources that are dependent on a specific load should exist avoided. For example, the file name is often non a good candidate for a record source, specially if it contains a appointment. The tape source should grouping all data together that comes from the same origin of data. Having a engagement in the tape source prevents this. The same applies for concrete database or server names: what if the location of the data changes? The file proper name, the database name or the server name might be changed in the futurity, even if the source where the records came from remains the aforementioned.

Read full chapter

URL:

https://www.sciencedirect.com/science/commodity/pii/B9780128025109000118

Embedded Machine Learning

Ian H. Witten , ... Mark A. Hall , in Data Mining (Third Edition), 2011

updateData()

Now that you lot know how to create an empty dataset, consider how the MessageClassifier object actually incorporates a new preparation message. The method updateData() does this job. It get-go converts the given message into a training instance by calling makeInstance(), which begins by creating an object of class Instance that corresponds to an case with 2 attributes. The constructor of the Instance object sets all the case'due south values to be missing and its weight to one. The side by side step in makeInstance () is to fix the value of the string attribute holding the text of the message. This is done by applying the setValue() method of the Example object, providing it with the attribute whose value needs to be changed, and a second parameter that corresponds to the new value'due south index in the definition of the string attribute. This index is returned by the addStringValue() method, which adds the message text every bit a new value to the cord aspect and returns the position of this new value in the definition of the string attribute.

Internally, an Instance stores all attribute values as double-precision floating-signal numbers regardless of the type of the corresponding attribute. In the case of nominal and string attributes this is done by storing the index of the corresponding attribute value in the definition of the attribute. For case, the outset value of a nominal aspect is represented by 0.0, the second past 1.0, and so on. The aforementioned method is used for string attributes: addStringValue() returns the index corresponding to the value that is added to the definition of the attribute.

Once the value for the string attribute has been set, makeInstance() gives the newly created case access to the data'south attribute information by passing information technology a reference to the dataset. In Weka, an Instance object does non store the type of each attribute explicitly; instead, it stores a reference to a dataset with the respective attribute information.

Returning to updateData(), one time the new instance has been returned from makeInstance(), its class value is fix and it is added to the grooming data. We besides initialize m_UpToDate, a flag indicating that the training information has inverse and the predictive model is therefore not up to engagement.

Read full chapter

URL:

https://www.sciencedirect.com/science/article/pii/B9780123748560000158

The Unit Modeler Development environment

Thomas D. Feigenbaum , in Building Intelligent Information Systems Software, 2016

Existing element context menu

Right-clicking on an existing element displays a context menu that allows you to edit, replace, or insert an element before the element that was clicked on. Figure 4.12 shows the context menu displayed when right-clicking an element.

Figure 4.12. The Set Carte and Submenu

Right-clicking on the 13 in Figure four.11 brings up this carte:

•

Set—The Set up submenu replaces the element with one of the selected options:

•

Pick—Puts the Unit Modeler in selection mode, allowing you to select something from the Whiteboard or from a form.

•

Number—Displays a list of System Vocabulary numbers. You can select a number from this listing to insert into the chemical element slot.

•

Vocabulary word…—Displays a list of all Organisation Vocabulary units. You lot can select a unit from this listing to insert into the element slot.

•

New string…—Prompts you to enter in a text string. Once you lot hit OK in the prompt dialog, a unit containing the string is created (in the same domain as the unit the string unit of measurement is inserted into) and inserted into the element slot. The string unit is also placed in the "Strings" attribute of the domain class respective to the domain the cord unit of measurement was created in.

•

Symbol—Displays another carte which allows you lot to select commonly used symbols (found in System Vocabulary).

•

Insert before—The Insert before submenu inserts an element earlier the element that was clicked on. It contains the aforementioned options equally the gear up menu.

•

Add *—Adds a star in front of the chemical element.

•

Remove *—Removes a star from the front of an element.

•

Virtual types—Allows you to modify an element to a virtual element (or from a virtual chemical element to a nonvirtual element).

•

Edit element path…—Shows a dialog that allows you to textually edit the chemical element path of an element.

•

Bear witness—Shows the base of operations of the element to the Whiteboard. This menu detail may sometimes appear as two different menu options: Show Base and Show Destination. For additional information near these menu items, refer to "Show Base vs. Show Destination" beneath.

•

Remove—Remove the specified element from the element list (at the element slot).

Insertion handle context menu

Figure 4.13 shows the insertion handle context menu.

Figure 4.13. A Unit with a List of Numbers and the Insertion Handle

Correct-clicking on the element insertion handle (the [] at the end of a unit's elements) displays a context bill of fare (Fig. 4.fourteen) that allows yous to append to the unit'due south elements.

Figure 4.14. The Right-Click Menu That Opens When the [] Character in Figure 4.13 Is Clicked

This menu, similar to the Set submenu of the existing element context menu, contains the following options:

•

Pick—Puts the Unit Modeler in pick mode, allowing yous to select something from the Whiteboard or from a form.

•

Number—Displays a list of Arrangement Vocabulary numbers. You lot can select a number from this list to insert into the element slot.

•

Vocabulary discussion…—Displays a list of all System Vocabulary units. You tin can select a unit from this list to insert into the element slot.

•

New cord…—Prompts yous to enter in a text string. Once you lot hit OK in the prompt dialog, a unit containing the string is created (in the aforementioned domain every bit the unit of measurement the string unit is inserted into) and inserted into the element slot. The string unit is also placed in the "Strings" attribute of the domain course corresponding to the domain the in which the string unit was created.

•

Symbol—Displays another menu which allows you lot to select commonly used symbols (found in System Vocabulary).

Show Base of operations vs. Bear witness Destination

Right-clicking on a complex element while in debug mode will ofttimes produce two different "Evidence" options in the element context menu: Show Base and Show Destination (Fig. four.15).

Effigy 4.xv. The Show Base and Show Destination Options Are Useful While Debugging Your Awarding

Because a complex element indirectly refers to some other unit of measurement (or units), information technology has two backdrop:

1.

A base: This is the unit of measurement from which the complex element was initialized. It is always the starting time unit listed in the circuitous element path. Thus, the base of the complex element School.*Students.Average GPA would be the School course unit of measurement.

2.

A destination: This is the unit of measurement or units which the circuitous element references. Thus, the destination of the circuitous element School.*Students.Average GPA would be the GPA attribute units of all of the Student classes in the Schoolhouse (i.e., a list of numeric units).

If we consider the process shown above, showing the base and the destination units could result in the process shown in Effigy four.sixteen.

Figure 4.xvi. The Base of operations and Destination Shown for the Unit to Set Unit

Read full chapter

URL:

https://www.sciencedirect.com/science/article/pii/B978012805101600004X

Design for Synthesis

Peter J. Ashenden , in The Designer'due south Guide to VHDL (Third Edition), 2008

21.ii.one Scalar Types

Models conforming with the synthesis standard may define and use enumeration types, with some restrictions. The predefined types boolean and scrap and the standard logic types std_ulogic and std_logic are implemented in hardware as individual bits. Almost of the fourth dimension, we utilise std_ulogic and std_logic , since that allows usa to represent loftier-impedance and unknown states, likewise as low and high logic levels. User-defined enumeration types may be implemented by tool-dependent encoding. Alternatively, nosotros may specify the encoding by decorating the type with a string attribute, enum_encoding, described in Section 21.7.

Models befitting with the synthesis standard may as well define and use integer types. Values of these types are implemented in the synthesized design every bit vectors of bits. If an integer blazon includes just non-negative values, the synthesized vector uses unsigned binary encoding. If the type includes negative values, 2'due south-complement signed encoding is used. The number of bits in the encoding is adamant past the range of values in the type. For example, given the post-obit declarations in a model:

blazon sample is range -64 to 63;

subtype table_index is natural range 0 to 1023;

values of type sample should be implemented using 7-flake 2's-complement encoding, and values of subtype table_index should be implemented using ten-bit unsigned encoding. Types that don't include 0 are encoded as though 0 were allowed. For example, the type

type index_type is range 4 to 15;

would be represented using 4-bit unsigned encoding. Synthesis tools conforming with the standard should support integers within the range -231 to +231 - 1, mapping to 32-bit two's-complement encoding.

The synthesis standard also allows use of other predefined enumeration types, including character, but they may not be supported by tools. The remaining classes of scalar types, namely, physical and floating-point types, are non supported by the synthesis standard. Definition and utilise of such types in a model are either ignored or treated equally an error.

Read total chapter

URL:

https://www.sciencedirect.com/science/article/pii/B9780120887859000216

Base Network Security

Kenneth Tam , ... Josh More , in UTM Security with Fortinet, 2013

Identity-Based Hallmark

Identity-based authentication provides user authentication at a firewall rule level. When identity-based authentication is enabled within a firewall rule, information technology allows you to further control traffic based on user identities. When this feature is enabled, identity rules can be divers as simply every bit a unmarried dominion linking traffic processing to identify or every bit more circuitous groups. In gild for the traffic to trigger the identity policy within firewall rule, the traffic first must authorize based on the rule source interface/zone, source network(south), destination interface/zone, and destination network(s).

Prior to creating an identity-based rule, you must offset define where authentication credentials will be referenced. There are two methods of identity authentication: firewall authentication, which would prompt the finish user for their login credentials, and Fortinet Single Sign On (FSSO) which is used in conjunction with Microsoft Agile Directory or Novell eDirectory infrastructure. This allows users to authenticate without being prompted for credentials if they take already logged in to the infrastructure.

Firewall Authentication

Firewall authentication credentials tin be stored locally or configured to use external authentication servers such as Radius, TACACS+, LDAP, or Fortinet's two-factor hallmark.

Local Authentication Database

Locally stored credentials for firewall authentication require a two step configuration procedure.

// First, ascertain the local login and related password

config user local

  edit <login name>

    set blazon countersign

    gear up passwd <password>

  side by side

cease

// 2nd, link the locally created login credentials to a FortiOS user grouping. This user group name is referenced in the identity firewall rule for firewall authentication

config user group

  edit <local database group name>

    fix group-type firewall

    // multiple login(s) are delimited by a space

    set member <local user name1> <local user name2> <...>

  adjacent

end

"set up group-blazon" should be set to "firewall" to enforce the firewall hallmark method. The other option of "fsso-service" would be used for MS AD integration, which will be discussed subsequently.

External Hallmark Databases

Using login credentials from an external authentication server also requires a two step process.

1.

Define an External Authentication Server (Radius, TACACS+, or LDAP).

2.

Add an External Authentication Server to a FortiOS User Group. Further external groups can then be divers inside the FortiOS user group definitions.

Defining a External Hallmark Server

External Hallmark via RADIUS: To configure a FortiGate to authenticate against a RADIUS server, y'all must, at minimum, define the type, shared hush-hush, server, and port.

config user radius

  edit <radius server name>

    set auth-type { auto | chap | ms_chap | ms_chap_v2 | pap }

    set secret <radius underground key>

    prepare server <radius server ip address>

    set radius-port <radius port number>

  next

end

"prepare auth-blazon { automobile | chap | ms_chap | ms_chap_v2 | pap }" defaults to "car" which negotiates in the post-obit club: pap, ms_chap_v2, and so chap. If car-negotiation is non desired, it can be explicitly divers (see Effigy 5.half dozen)

Effigy five.6. Web UI RADIUS Settings

External Authentication via TACACS+

To configure a FortiGate to cosign against a TACACS+ server, you must, at minimum, define the type, server, port, and cardinal.

config user tacacs+

  edit <tacacs+ server name>

    gear up authen-blazon { ascii | auto | chap | ms_chap | pap }

    set server <tacacs+ server ip address>

    prepare port <tacacs+ server port>

    ready key <tacacs+ secret key>

  side by side

end

"set authen-type" defaults to "automobile" which negotiates in the order: pap, ms_chap, then chap. As with RADIUS, this hallmark blazon can be explicitly defined.

External Authentication via LDAP

Due to the complexity inherent in LDAP, it is somewhat more difficult to configure.

config user ldap

  edit <ldap server name>

    ready server <ldap server ip address>

    prepare port <ldap server port>

    prepare type { simple | anonymous | regular }

// if 'type' is defined equally 'regular' and so 'username' & 'password' are required

// 'secure' is an option and, if defined, Requires 'ca-cert'

      gear up username <ldap 'regular' login proper noun>

      set password <ldap 'regular' login password>

      set up secure <disable | ldaps | starttls>

      set ca-cert <document name on FortiGate>

    fix cnid <common proper name identifier>

    fix dn <distinguished name path>

    ready member-attr <attribute string>

    set grouping-member-cheque <grouping-object | user-attr>

// if 'group-member-bank check' is defined as 'group-object' so 'group-object-filter' is needed

      set group-object-filter <group object filter cord>

  next

end

As of this writing, yous can define up to ten LDAP server definitions. FortiOS supports the LDAP protocol (RFC2251) for looking up and validating user credentials. It is compliant with all servers that support up to LDAP v3. As Microsoft'southward Active Directory service (AD) is based on LDAP, FortiOS's LDAP can reference it. However, FortiOS does not support whatsoever proprietary extensions, such as countersign expiration notifications, etc.

"ready cnid <mutual name identifier>" defaults to the LDAP Canonical Proper name or "cn". In an Advert environs, this is the "Display Name" identifier of an Advertising user. If there'due south a need to reference the bodily Advert logon name, this value can be inverse to "sAMAccountName" via "set cnid sAMAccountName"

To check the "Brandish Name" (cn) vs. a "Logon Name" (sAMAccountName) on a Microsoft Directory server, run the following commands from the Microsoft Windows Command Prompt.

// to show the Display Name (cn) linked to a sAMAccountName

# dsquery user -name <sAMAccountName>

//to show the Logon Proper noun (sAMAccountName) linked to a Brandish Name (cn)

# dsquery user -samid <brandish name>

"set dn <distinguished name path>" defines the bureaucracy of the LDAP database object classes above the common proper noun identifier (cnid setting). In an Advertisement infrastructure, the root is defined by "dc", organizational unit of measurement is defined with "ou", and the container or user group are defined past "cn".

For example, to query the LDAP server for a user named "fortiuser" who belongs in a user group named "Users" nether domain.test.com, yous must specify the dn path equally:

"cn=Users,dc=domain,dc=test,dc=com". This restricts the LDAP server to query merely the "Users" group. Alternately, the dn path tin be defined every bit: "dc=domain,dc=test,dc=com" which would encompasses any other ou or cn beneath it.

"set member-attr <aspect string>" defaults to "memberOf" for MS Advertizing or Open LDAP apply. If you lot are using Novell's eDirectory server, this value should be changed to "groupMembership", due east.m. "fix member-attr groupMembership".

"set group-fellow member-cheque <group-object | user-attr>" defaults to "user-attr". If set to "group-object" and then the "set group-object-filter" would need to be defined. Past default, group-object-filter is divers every bit "(&(objectcategory=grouping)(member=*))" which works well with a Microsoft network. Other examples of group-object-filter are:

(&(objectclass=groupofnames)(member=*))

(&(objectclass=groupofuniquenames)(uniquemember=*))

(&(objectclass=posixgroup)(memberuid=*)) // typically used with Open LDAP

See Appendix B—Troubleshooting for additional details on using CLI debug commands to test the external authentication servers. You can run a debug test on a username to find group membership data. This can exist used to further tune the definitions (run into Figure 5.7).

Effigy 5.7. Spider web UI LDAP Setting
Adding an External Authentication Server to a FortiOS User Grouping

config user group

  edit <user authentication group name>

    set group-blazon firewall

    // Multiple external servers are delimited by a space

    set member <external server name1> <external server name2> <...>

    config lucifer

      edit <entry number>

        set service-proper name <external server proper noun>

        ready group-name <name of external server group>

      next

    end

finish

To enforce the firewall authentication method, the command "set group-type" should exist set to "firewall". The other pick of "fsso-service" would exist used for AD integration and will be discussed later.

Likewise external servers, "set member" can also reference local accounts. The section preceding "config match" defines the external authentication server groups that are tied to a specific external authentication server. Each "edit <entry number>" is processed from top to bottom for login searches. Each entry defines the external server and the respective external groups.

External group definitions vary based on the type of external hallmark servers used. For RADIUS and TACACS+, the external grouping proper noun should match the group name passed in the Vendor Specific Attribute (VSA) Fortinet-Group-Proper name. Tabular array 5.one shows an example of the FortiOS RADIUS VSA lexicon on the supported attributes. However, this can modify with technology. Updated versions of this dictionary are available under the support site inside the GA or MR download directories.

Table 5.i. FortiOS Radius VSA Dictionary

# FortiOS v4.0 MR3 RADIUS VSA Lexicon
VENDOR Fortinet 12356
BEGIN-VENDOR Fortinet
ATTRIBUTE Fortinet-Group-Name i string
Attribute Fortinet-Client-IP-Address 2 ipaddr
ATTRIBUTE Fortinet-Vdom-Name iii cord
ATTRIBUTE Fortinet-Client-IPv6-Accost 4 octets
ATTRIBUTE Fortinet-Interface-Name 5 string
ATTRIBUTE Fortinet-Access-Contour 6 cord
END-VENDOR Fortinet
#

The external grouping definition for an LDAP server should consist of a full dn path for the login credential in question. Equally noted in the above example, the grouping-name would be "set grouping-name cn=Users,dc=domain,dc=examination,dc=com".

Local or External Authentication Server Firewall Authentication Identity-Based Policies

config firewall policy

  edit <dominion number>

    fix srcintf <interface or zone name>

    set dstintf <interface or zone name>

    prepare srcaddr <address object proper name>

    fix dstaddr <address object proper noun>

    fix action accept

    config identity-based-policy

      edit <id rule number>

        set groups <FortiOS user group>

        gear up schedule <schedule name>

        set service <service proper noun objects(south)>

        …

      next

    end

  next

end

Cosmos of an identity rule is done within an existing firewall rule. Once an identity-based policy is enabled, rules must be added, otherwise all traffic would be implicitly denied.

When an identity-based policy is enabled, the only required settings are the source and destination interface and the network objects needed to trigger farther inspection.

"config identity-based-policy" defines the sub-rule section for identity-based rules. Within this department, dominion entries are created much like the FortiOS firewall. Each identity dominion starts with "edit <id rule number>", where a single FortiOS user grouping is specified along with the related service access controls: "set service <service name object(s)>", schedule, and whatsoever related UTM security inspection requirements.

When using identity-based rules, order is important, as the rules are processed top to bottom. Prior to FortiOS 4.0 MR3, if a user does not belong in one FortiOS user group then the each next rule would be inspected in turn until a match is made, otherwise the session would be denied. Starting in FortiOS 4.0 MR3, this behavior was changed with the following setting:

config user setting

  set auth-multi-grouping {enable | disable}

  set auth-timeout-type {idle-timeout | hard-timeout | new-session}

  set auth-timeout <seconds>

end

"set auth-multi-group" is enabled past default, allowing inspection for users belonging to multiple user groups.

In add-on to the "config user setting", there are authentication timeout settings that can be defined for authenticated user sessions. The "set auth-timeout-blazon" provides three types of hallmark timeout methods divers by "ready auth-timeout". All user settings are defined per VDOM.

"prepare auth-timeout-type idle-timeout" forces the user to re-authenticate their session if it goes idle. The timeout length is set under "set auth-timeout <seconds>". If you need to forcefulness the user to re-authenticate regardless of idle or non-idle traffic, you must employ the difficult timeout as ready in "prepare auth-timeout-type hard-timeout".

If you lot demand a timeout that functions like a hard timeout, only simply forces new sessions to exist re-authenticated, y'all must use "set up auth-timeout-type new-session". This can exist useful for cases where the security of re-hallmark is needed, just users balk at the difficulty of a hard timeout.

FSSO (Fortinet Single Sign On)

Originally FSSO was named Fortinet Server Authentication Extension, but it was renamed in FortiOS 4.0 MR3. FSSO provides a transparent authentication experience for users that have already authenticated to a Microsoft or Novell environs. It is transparent in that, from an end user perspective, users are not prompted for credentials if they are already logged into the directory service.

FortiOS communicates directly with an FSSO agent. This amanuensis is installed on the hallmark infrastructure and determines whether the user is logged in. It as well correlates the user's IP data so the session may be tracked within FortiOS.

IPv6 Tip

IPv6 Identity Base of operations Authentication back up

Equally of this writing, FortiOS MR3, FSSO, & NTLM hallmark is not supported for IPv6. Only firewall authentication where the user would be prompted for credentials.

In the adjacent sections nosotros'll get over the basic configuration needed to go FSSO working. Notwithstanding, before this tin be done, you lot must decide in which mode you lot will run the FSSO agent.

The FSSO agent can be deployed in one of two modes: DC Agent or Polling. In a Novell eDirectory surroundings, only the Polling fashion is supported. For AD environments, the differences betwixt these ii modes follow.

DC (information collector) Agent Mode:

•

Requires the installation of a file (dcagent.dll, 100   KB) on each of the domain controllers within the domain being monitored. This file is installed within the Windows\system32 directory of the domain controller server.

•

No services run in this fashion.

•

After this file is installed, the domain control must be rebooted. When using multiple domain controllers, the reboot may exist staggered to preclude reanimation for the domain.

•

The agent sends logon events to the Collector Agent and requires a minimum of 64 kilo $.25 per second of bandwidth added to the network load

•

Provides an accurate capture of all logon events

Polling Fashion:

•

Does not crave any software to be installed on domain controllers. Only requires that a Collector Agent exist installed on any automobile on the domain.

•

The CA will poll logon events from each individual domain controller. In an Advertizement infrastructure, communication from CA to domain controllers requires that TCP port 445 be opened to the DC servers.

•

Polling mode is less reliable then agent style, equally the events are only seen once they are polled. During heavy system or network load, the polling timeframe may need to be increased, thereby further decreasing reliability.

In an Advert infrastructure, events do not signal when a user logs off. To accurately runway whether a user is still logged onto a calculator, it is recommended that all end user workstations exist immune to communicate with the CA server on TCP ports 139 or 445. This allows access to registry data to determine whether the user is still logged onto the reckoner. This is divers past the CA workstation verification interval, which defaults to five minutes. If your internal policy does not allow advice on these ports, then you should disable workstation verification by changing the interval setting to zero.

FortiOS FSSO Amanuensis Communication Setup

Once the FSSO agent method has been determined and the agent configured on the server, the side by side step is to define the FSSO advice between FortiOS and the FSSO Collector Agent. For both Advertizement and eDirectory, the FSSO Standard style tin be configured. Use of the Avant-garde FSSO fashion requires AD. In contrast to the standard way, where the user group filter is defined on the CA server, the avant-garde mode allows for group filters to be defined on the FortiGate using LDAP queries. This provides the ability to support nested or inherited user groups.

// If using FSSO Standard style

config user fsso

  edit <proper noun>

    set up server <IPv4 address of server with FSSO collector agent>

    ready port <server port - default 8000>

    set password <password to match FSSO collector agent settings>

  next

end

// If using FSSO Advance access manner

config user fsso

  edit <proper name>

    set server <IPv4 address of server with FSSO collector agent>

    set port <server port - default 8000>

    set password <password to match FSSO collector amanuensis settings>

    set ldap-server <LDAP server proper name>

  next

terminate

Adding FSSO FortiOS User Groups

config user group

  edit <user authentication group name>

    set group-type fsso-service

    // Multiple AD/Novell groups are delimited past a space

    set member <group name1> <group name2> <...>

end

To enforce FSSO authentication, "set group-blazon" should be fix to "fsso-service".

FSSO Identity-Based Policies

config firewall policy

  edit <dominion number>

    ready srcintf <interface or zone proper noun>

    gear up dstintf <interface or zone name>

    set srcaddr <address object name>

    set up dstaddr <address object proper noun>

    set activity accept

    config identity-based-policy

      edit <id dominion number>

        gear up groups <FortiOS FSSO user group>

        set schedule <schedule proper name>

        set service <service proper noun objects(s)>

        …

      next

    end

  side by side

end

FSSO identity rules are similar to those used for firewall authentication except the "set groups" definition would reference the FSSO user group proper noun rather than a FortiOS firewall authentication user group name.

When Ad authentication does not match any of the identity-based rules just non-authenticated users must still be controlled, you must create a default "lesser" rule. This default rule needs to be assigned to the "FSSO_Guest_Users" for the "gear up groups" definition.

Read full chapter

URL:

https://world wide web.sciencedirect.com/science/commodity/pii/B9781597497473000053