Remote authentication for administrators

Administrators can use remote authentication, such as LDAP, RADIUS, and TACACS+ to connect to the FortiGate.

Local logins can also be restricted when remote authentication servers are available, see Restricting logins from local administrator accounts when remote servers are available.

Setting up remote authentication for administrators includes the following steps:

1. Configuring the LDAP server
2. Adding the LDAP server to a user group
3. Configuring the administrator account

Configuring the LDAP server

To configure the LDAP server in the GUI:

1. Go to User & Authentication > LDAP Servers and click Create New.
2. Enter the server Name and Server IP/Name.
3. Enter the Common Name Identifier and Distinguished Name.
4. Set the Bind Type to Regular and enter the Username and Password.
5. Click OK.

To configure the LDAP server in the CLI:

config user ldap
    edit <name>
        set server <server_ip> 
        set cnid "cn" 
        set dn "dc=XYZ,dc=fortinet,dc=COM" 
        set type regular 
        set username "cn=Administrator,dc=XYA, dc=COM" 
        set password <password> 
    next 
end

Adding the LDAP server to a user group

After configuring the LDAP server, create a user group that includes that LDAP server.

To create a user group in the GUI:

1. Go to User & Authentication > User Groups and click Create New.
2. Enter a Name for the group.
3. In the Remote groups section, select Create New.
4. Select the Remote Server from the dropdown list.
5. Click OK.

To create a user group in the CLI:

config user group
    edit <name>
        set member <ldap_server_name>
    next
end

Configuring the administrator account

After configuring the LDAP server and adding it to a user group, create a new administrator. For this administrator, instead of entering a password, use the new user group for authentication.

To create an administrator in the GUI:

1. Go to System > Administrators and click Create New > Administrator.
2. Specify the Username.
3. Set Type to Match all users in a remote server group.
4. In Remote User Group, select the user group you created.
5. Select an Administrator Profile.
6. Click OK.

To create an administrator in the CLI:

config system admin
    edit <name>
        set remote-auth enable
        set accprofile super_admin
        set wildcard enable
        set remote-group <ldap_group_name>
    next
end

The Match all users in a remote server group option acts as a wildcard for matching any users against the remote server group. The Match a user on a remote server group option only matches the username defined to match against the remote server group, which is the equivalent of using set wildcard disable.

Other methods of administrator authentication

Administrator accounts can use different methods for authentication, including RADIUS, TACACS+, and PKI.

RADIUS authentication for administrators

To use a RADIUS server to authenticate administrators, you must:

1. Configure the FortiGate to access the RADIUS server.
2. Create the RADIUS user group.
3. Configure an administrator to authenticate with a RADIUS server.

TACACS+ authentication for administrators

To use a TACACS+ server to authenticate administrators, you must:

1. Configure the FortiGate to access the TACACS+ server.
2. Create a TACACS+ user group.
3. Configure an administrator to authenticate with a TACACS+ server.

PKI certificate authentication for administrators

To use PKI authentication for an administrator, you must:

1. Configure a PKI user.
2. Create a PKI user group.
3. Configure an administrator to authenticate with a PKI certificate.

Restricting logins from local administrator accounts when remote servers are available

Logins from local administrator accounts can be restricted when remote servers are available. When enabled, FortiOS will check if all of the remote servers used by administrators are down before allowing a local administrator to log in. This option is applied globally, and is disabled by default.

To restrict local administrator authentication when a remote authentication server available:

config system global
    set admin-restrict-local enable
end