Fortinet black logo

Administration Guide

RADIUS

RADIUS

If you have existing RADIUS servers, you may choose to continue using them with FortiAuthenticator by configuring them as remote RADIUS servers. This feature can also be used to migrate away from third-party two-factor authentication platforms.

When entering the remote RADIUS server information, if any information is missing or in the wrong format, error messages will highlight the problem for you.
To add a remote RADIUS server entry:
  1. Go to Authentication > Remote Auth. Servers > RADIUS and select Create New. The Create New RADIUS Server window opens.
  2. Enter the following information, then select OK to add the RADIUS server.
    NameEnter the name for the remote RADIUS server on FortiAuthenticator.
    Preferred auth. methodSelect from either MSCHAPv2 (by default), MSCHAP, CHAP, or PAP.
    Timeout

    Enter a timeout in seconds between 1-60 seconds (3 by default).

    Note that a high timeout may impact the processing rate of authentication requests if the remote RADIUS server becomes unresponsive.

    Primary ServerEnter the server name or IP address, port, and secret in the fields provided to configure the primary server.
    Secondary ServerOptionally, add redundancy by configuring a secondary server.
    User Migration

    Select Enable learning mode to record and learn users that authenticate against this RADIUS server. This option should be enabled if you need to migrate users from the server to the FortiAuthenticator.

    Select View Learned Users to view the list of learned users. See Learned RADIUS users.

RADIUS

If you have existing RADIUS servers, you may choose to continue using them with FortiAuthenticator by configuring them as remote RADIUS servers. This feature can also be used to migrate away from third-party two-factor authentication platforms.

When entering the remote RADIUS server information, if any information is missing or in the wrong format, error messages will highlight the problem for you.
To add a remote RADIUS server entry:
  1. Go to Authentication > Remote Auth. Servers > RADIUS and select Create New. The Create New RADIUS Server window opens.
  2. Enter the following information, then select OK to add the RADIUS server.
    NameEnter the name for the remote RADIUS server on FortiAuthenticator.
    Preferred auth. methodSelect from either MSCHAPv2 (by default), MSCHAP, CHAP, or PAP.
    Timeout

    Enter a timeout in seconds between 1-60 seconds (3 by default).

    Note that a high timeout may impact the processing rate of authentication requests if the remote RADIUS server becomes unresponsive.

    Primary ServerEnter the server name or IP address, port, and secret in the fields provided to configure the primary server.
    Secondary ServerOptionally, add redundancy by configuring a secondary server.
    User Migration

    Select Enable learning mode to record and learn users that authenticate against this RADIUS server. This option should be enabled if you need to migrate users from the server to the FortiAuthenticator.

    Select View Learned Users to view the list of learned users. See Learned RADIUS users.