Remote authentication for administrators

Administrators can use remote authentication, such as LDAP, to connect to the FortiGate.

Setting up remote authentication for administrators includes the following steps:

1. Configure the LDAP server
2. Add the LDAP server to a user group
3. Configure the administrator account

Configure the LDAP server

To configure the LDAP server in the GUI:

1. Go to User & Authentication > LDAP Servers and select Create New.
2. Enter the server Name, Server IP address or Name.
3. Enter the Common Name Identifier and Distinguished Name.
4. Set the Bind Type to Regular and enter the Username and Password.
5. Click OK.

To configure the LDAP server in the CLI:

config user ldap
  edit <ldap_server_name>
    set server <server_ip> 
    set cnid "cn" 
    set dn "dc=XYZ,dc=fortinet,dc=COM" 
    set type regular 
    set username "cn=Administrator,dc=XYA, dc=COM" 
    set password <password> 
  next 
end

Add the LDAP server to a user group

After configuring the LDAP server, create a user group that includes that LDAP server.

To create a user group in the GUI:

1. Go to User & Authentication > User Groups and select Create New.
2. Enter a Name for the group.
3. In the Remote groups section, select Create New.
4. Select the Remote Server from the dropdown list.
5. Click OK.

To create a user group in the CLI:

config user group
  edit <Group_name>
    set member "ldap_server_name"
  next
end

Configure the administrator account

After configuring the LDAP server and adding it to a user group, create a new administrator. For this administrator, instead of entering a password, use the new user group and the wildcard option for authentication.

To create an administrator in the GUI:

1. Go to System > Administrators.
2. Select Create New > Administrator.
3. Specify the Username.
4. Set Type to Match a user on a remote server group.
5. In Remote User Group, select the user group you created.
6. Select Wildcard.

   The Wildcard option allows LDAP users to connect as this administrator.

7. Select an Administrator Profile.
8. Click OK.

To create an administrator in the CLI:

config system admin
  edit <admin_name>
    set remote-auth enable
    set accprofile super_admin
    set wild card enable
    set remote-group ldap
end

Other methods of administrator authentication

Administrator accounts can use different methods for authentication, including RADIUS, TACACS+, and PKI.

RADIUS authentication for administrators

To use a RADIUS server to authenticate administrators, you must:

• Configure the FortiGate to access the RADIUS server.
• Create the RADIUS user group.
• Configure an administrator to authenticate with a RADIUS server.

TACACS+ authentication for administrators

To use a TACACS+ server to authenticate administrators, you must:

• Configure the FortiGate to access the TACACS+ server.
• Create a TACACS+ user group.
• Configure an administrator to authenticate with a TACACS+ server.

PKI certificate authentication for administrators

To use PKI authentication for an administrator, you must:

• Configure a PKI user.
• Create a PKI user group.
• Configure an administrator to authenticate with a PKI certificate.