Remote authentication for administrators

Administrators can use remote authentication, such as LDAP, RADIUS, and TACACS+ to connect to the FortiGate.

Configuring remote authentication with an LDAP server is shown. For more information about configuring LDAP, see Configuring an LDAP server.

For information about configuring RADIUS or TACACS+ servers, see Configuring a RADIUS server and TACACS+ servers. To use a RADIUS or TACACS+ server for remote authentication, configure the server, and then add it to the user group instead of the LDAP server.

Local logins can also be restricted when remote authentication servers are available, see Restricting logins from local administrator accounts when remote servers are available.

Configuring remote authentication for administrators using LDAP includes the following steps:

1. Configuring the LDAP server

2. Adding the LDAP server to a user group

3. Configuring the administrator account

Configuring the LDAP server

To configure the LDAP server in the GUI:

1. Go to User & Authentication > LDAP Servers and click Create New.

2. Enter the server Name and Server IP/Name.

3. Enter the Common Name Identifier and Distinguished Name.

4. Set the Bind Type to Regular and enter the Username and Password.

5. Click OK.

To configure the LDAP server in the CLI:

config user ldap
    edit <name>
        set server <server_ip> 
        set cnid "cn" 
        set dn "dc=XYZ,dc=fortinet,dc=COM" 
        set type regular 
        set username "cn=Administrator,dc=XYA, dc=COM" 
        set password <password> 
    next 
end

Adding the LDAP server to a user group

After configuring the LDAP server, create a user group that includes that LDAP server.

To create a user group in the GUI:

1. Go to User & Authentication > User Groups and click Create New.

2. Enter a Name for the group.

3. In the Remote groups section, select Create New.

4. Select the Remote Server from the dropdown list.

5. Click OK.

To create a user group in the CLI:

config user group
    edit <name>
        set member <ldap_server_name>
    next
end

Configuring the administrator account

After configuring the LDAP server and adding it to a user group, create a new administrator. For this administrator, instead of entering a password, use the new user group for authentication.

A remote authentication server can allow authentication of either a single user or any user from a specified group.

Public key infrastructure (PKI) administrator authentication requires a PKI user instead of a remote server. For information about creating a PKI user, see Configuring a PKI user.

To create an administrator to match a single user in the GUI:

1. Go to System > Administrators and click Create New > Administrator.

2. Specify the Username.

   This username is used when the administrator logs in, and is what FortiOS sends to the remote authentication server for authorization.

3. Set Type to Match a user on a remote server group.

4. In Remote User Group, select the user group that you created.

5. Select an Administrator Profile.

6. Enter a Backup Password, to be used if the remote authentication server is unreachable.

7. Click OK.

To create an administrator match a single user in the CLI:

config system admin
    edit <name>
        set remote-auth enable
        set accprofile super_admin
        set remote-group <ldap_group_name>
        set password **********
    next
end

To create an administrator to match all users in a remote server group in the GUI:

1. Go to System > Administrators and click Create New > Administrator.

2. Specify the Username.

   This username is only used to identify this administrator group. Administrators can log in with any username in the remote user group.

3. Set Type to Match all users in a remote server group.

4. In Remote User Group, select the user group that you created.

5. Select an Administrator Profile.

6. Click OK.

To create an administrator to match all users in a remote server group in the CLI:

config system admin
    edit <name>
        set remote-auth enable
        set accprofile super_admin
        set wildcard enable
        set remote-group <ldap_group_name>
    next
end

To create an administrator that uses a PKI group in the GUI:

1. Go to System > Administrators and click Create New > Administrator.

2. Specify the Username.

3. Set Type to Use public key infrastructure (PKI) group.

4. In Remote User Group, select the user group that you created.

5. Select an Administrator Profile.

6. Click OK.

To create an administrator that uses a PKI group in the CLI:

config system admin
    edit <name>
        set remote-auth enable
        set accprofile super_admin
        set peer-group <pki_group_name>
    next
end

Restricting logins from local administrator accounts when remote servers are available

Logins from local administrator accounts can be restricted when remote servers are available. When enabled, FortiOS will check if all of the remote servers used by administrators are down before allowing a local administrator to log in. This option is applied globally, and is disabled by default.

To restrict local administrator authentication when a remote authentication server available:

config system global
    set admin-restrict-local enable
end