RADIUS
If you have existing RADIUS servers, you may choose to continue using them with FortiAuthenticator by configuring them as remote RADIUS servers. This feature can also be used to migrate away from third-party two-factor authentication platforms.
![]() |
When entering the remote RADIUS server information, if any information is missing or in the wrong format, error messages will highlight the problem for you. |
To add a remote RADIUS server entry:
- Go to Authentication > Remote Auth. Servers > RADIUS and select Create New. The Create New RADIUS Server window opens.
- Enter the following information, then select Save to add the RADIUS server.
Name Enter the name for the remote RADIUS server on FortiAuthenticator. Preferred auth. method Select from either MSCHAPv2 (by default), MSCHAP, CHAP, PAP, or Proxy.
Note: The Proxy option allows FortiAuthenticator to proxy RADIUS authentication sessions without changing the authentication method, meaning FortiAuthenticator passes the authentication credentials sent by the RADIUS client through to the remote RADIUS server unchanged.
Timeout Enter a timeout in seconds between 1-60 seconds (3 by default).
Note that a high timeout may impact the processing rate of authentication requests if the remote RADIUS server becomes unresponsive.
Include realm in username
Enable for eduroam services.
When enabled, the username string sent to the remote RADIUS server is the same as the username string received from the RADIUS client.
FortiAuthenticator can now keep the realm portion of the username before proxying.
This allows FortiAuthenticator to route the RADIUS authentication requests through a hierarchy of RADIUS authentication proxy servers.
Note: The option is disabled by default.
Primary Server Enter the server name or IP address, port, and secret in the fields provided to configure the primary server. Secondary Server (Optional Redundancy) Optionally, add redundancy by configuring a secondary server. User Migration Select Enable learning mode to record and learn users that authenticate against this RADIUS server. This option should be enabled if you need to migrate users from the server to the FortiAuthenticator.