Identity and access management

Secure authentication is paramount in the implementation of an effective security policy. Many of the most damaging security breaches are due to compromised user accounts. By identifying and authenticating users, a significantly more granular control can be implemented to ensure that the right users are accessing the right network resources.

FortiGate supports identifying users in many different ways, including but not limited to:

• Local: The username and password are stored on the FortiGate.

• Remote: The username and password are stored on a remote server, such as LDAPS or TACACS+, that the FortiGate queries.

• PKI/peer: Users that authenticate using a client certificate.

When configuring an LDAP connection to an Active Directory server, an administrator must provide Active Directory user credentials. To secure this connection, use LDAPS on both the Active Directory server and FortiGate. See Configuring an LDAP server. Apply the principle of least privilege. For the LDAP regular bind operation, do not use credentials that provide full administrative access to the Windows server when using credentials. See Configuring least privileges for LDAP admin account authentication in Active Directory. When connecting to RADIUS over UDP, it is recommended to ensure the FortiGate and RADIUS connection passes through a trusted network or the connection passes through an encrypted tunnel over untrusted networks. If the traffic must pass through an untrusted network without going through an encrypted tunnel, consider upgrading to FortiOS 7.4.0 or later, where RADSEC over TLS is supported as a transport protocol.

Authentication can be configured for:

• Administrative access

• Firewall authentication and SSO

• VPN

• Wireless security

• 802.1X port security

The most effective authentication includes more than one of the following:

• Something that the user knows: a username and password

• Something that the user has: a certificate, a one time password (OTP) in the form of a token or code either sent to the user over email or SMS, or generated by a hardware token or authenticator app.

• Something specific to the user: biometric data, such as a fingerprint

Single sign-on (SSO) can be used to reduce user fatigue by allowing users to only authenticate one time to gain access to all permitted resources.

FortiClient provides a solution to user and device identification, and can function as an SSO agent. It is also part of the Zero Trust Network Access (ZTNA) solution, allowing security posture checks along with authentication.

Note that, when implementing MFA on the FortiGate, a FortiToken can only be registered to one FortiGate at a time. If you use a remote authentication server for MFA, then each FortiGate points to the server. FortiAuthenticator and FortiToken Cloud are remote authentication servers that can manage the FortiTokens for multiple FortiGates at the same time. This allows you to use one token per user across multiple FortiGates.