DOCUMENT LIBRARY

FortiGate / FortiOS

FortiManager

FortiAnalyzer

Examples

Introduction
FortiToken and FortiToken Mobile
- 2FA with FortiToken Mobile
RADIUS authentication
- 2FA on FortiPAM for RADIUS users using FortiAuthenticator
SAML authentication
- 2FA on FortiPAM for SAML users using FortiAuthenticator
JWT
- JWT (JSON Web Token) integration with DevOps
ZTNA
- ZTNA endpoint control on FortiPAM
Secret configurations
- Accessing a Linux server using PuTTY
  - Creating a secret with Unix template
  - Launching a secret for the Linux server
- Accessing a Cisco router using PuTTY
  - Creating an associated secret
  - Creating a secret with Cisco User (SSH Secret) template
  - Launching a secret for the Cisco router
- Accessing a FortiGate using PuTTY, Web SSH, or the Web launcher
  - Creating a secret with Unix template
  - Launching a secret for the FortiGate
- Accessing a Windows server using the Remote Desktop- Windows launcher
  - Creating a secret with Windows Machine template
  - Launching a secret for the Windows server
- Visiting a web application/platform using web launchers
  - Installing Fortinet Privileged Access Agent web extension on Chrome/Edge
  - Creating a secret for general web application/platform
  - Creating a secret for AWS root/IAM account
  - Visiting web application/platform using web launcher
  - Reviewing video recording for the web launching session
  - Reviewing secret log for the web launching session
- Accessing a generic machine using Web VNC, VNC Viewer, or the TightVNC launcher
  - Creating a secret with Machine template
  - Launching a secret for the machine
- Accessing a target server using locally installed WinSCP client
  - Installing WinSCP on a local machine
  - Creating a secret with Unix Account (SSH Password) template
  - Launching a secret for the target server using the WinSCP launcher
- Accessing an SFTP server using the Web SFTP secret launcher
  - Creating a secret with Unix Account (SSH Password) template
  - Launching a secret for the SFTP server using the Web SFTP launcher
- Accessing an SMB server using Web SMB launcher
  - Creating a secret with Windows Domain Account (Samba) template
  - Verifying the password
  - Launching a secret for the SMB server using the Web SMB launcher
- Checking out and checking in a secret
  - Creating a secret with check out enabled
  - Checking out a secret
  - Checking in a secret
- Using a secret requiring approval
  - Creating an approval profile
  - Creating a secret with mandatory approval requirement
  - Sending a request to access a secret
  - Approving a secret request
  - Launching a secret that requires approval
- Running a script on a target server using jobs
  - Creating a job approval profile
  - Creating a secret with mandatory approval requirement for launching a job
  - Creating an ssh script type job
  - Sending a request to access the job
  - Approving a job request
  - Results
- Configuring a secret that supports TOTP
  - Configuring a secret template with TOTP
  - Creating a secret with TOTP enabled
- Accessing a MySQL server using MySQL CLI launcher
  - Creating a secret using the database server template
  - Launching a secret for the MySQL server
- Configuring integrity check for the PuTTY launcher
  - Creating an entry for the PuTTY launcher
  - Enabling integrity check in the launcher and secret template
  - Creating a secret with integrity check
  - Launching the secret
- Block uploading a JavaScript file via the Web SFTP launcher
  - Configuring the DLP file pattern
  - Configuring a DLP sensor profile
  - Creating a secret with a DLP sensor profile
  - Results
- Block transferring .exe files and log file downloads of size larger than 500KB
  - Configuring the DLP file pattern
  - Configuring a DLP sensor profile
  - Creating a secret with a DLP sensor profile
  - Results
- Updating a service account credential
  - Updating a service account credential
- Creating a secret with the Certificate Vault template
  - Creating a certificate secret
  - Setting up email alert for certificate expiry
- Configuring a secret using the Target Only secret template
  - Example 1: Creating a secret using the Target Only template
  - Example 1: Launching the secret
  - Example 2: Creating a secret using the Target Only template
  - Example 2: Launching the secret
- Smart association for Windows AD server as the target
  - Creating a secret with Windows Domain Account as the secret template
  - Creating a remote user
  - Results
- Access multiple Windows servers on the same domain
  - Creating targets
  - Creating a secret for the domain user
  - Creating a secret for the Windows PC- 10.59.112.201 and Windows PC- 10.59.112.208
  - Sharing secrets to a contractor
  - Result
- Azure AD password changer
  - Configuring the Azure portal
  - Configuring FortiPAM
  - Results
  - Troubleshooting
Audit
- Sponsored administrator audits secret activities
Web proxy
- Configuring the web proxy feature to prevent web credentials from leaking
RDP log retrieval
- RDP log retrieving on FortiPAM
Gateway
- FortiPAM connects to a target through a FortiProxy acting as the gateway
- Configuring FortiPAM/FortiGate as the reverse gateway
- Configuring FortiGate forwarding access request from FortiPAM to the private target
SSH filter profiles
- Configuring an SSH filter profile on FortiPAM to restrict SSH access to secret servers
  - Configuring SSH filter profiles in the CLI
  - Configuring SSH filter profiles using the GUI
Automation
- Using default automation stitch- Secret Credential View
  - Using the Secret Credential View automation stitch
  - Results
- Customizing an automation stitch
Windows application filter
- Creating a Windows application filter to prevent running executables
- Creating a non-Windows application filter to prevent running executables
  - Creating a target with server information as non-Windows
  - Creating a non-privilged secret
Web launcher
- Using web launcher to auto fill credentials on a website
Log and video disks
- Back up and restore your log and video files
Certificate management
- Configuring certificate using the ACME protocol to access a FortiPAM instance
  - Creating a certificate
  - Configuring the FortiPAM SSL certificate
- How to deploy FortiPAM CA to Windows host using EMS and FortiClient
Logging servers
- FortiAnalyzer Cloud as a logging server
FortiGate
- FortiPAM behind FortiGate
Change Log

Home FortiPAM 1.8.0 Examples

1.8.0

Configuring a gateway on the FortiPAM server

To configuring a gateway on the FortiPAM server:

Go to Secrets > Gateway.
In the Gateways list, select +Create.
The New Gateway window opens.
In Name, enter a name for the gateway.
Ensure that the Status is enabled.
Ensure that Type is Forward.
In Address, enter the IP address of the forward proxy.
This was set up on port1 in Configuring forward gateway on FortiGate.
In Port, enter the gateway port number.
In this example, it is 8443.
This was set up in Configuring a gateway on the FortiPAM server.
Ensure that the SSL Max Version is TLS 1.3 (default).
Ensure that the TCP Forwarding Path is tcp (default). This tells the gateway how to internally process the request from FortiPAM.
Optionally, enter a description.
Click Submit.

Client Certificate is required only when client-cert is enabled in Configuring forward gateway on FortiGate.

CA Certificate is the CA for the FortiGate certificate configured in Configuring forward gateway on FortiGate (ssl-certificate).

If it is not configured, FortiPAM server does not check the FortiGate certificate during the TLS handshake.

Configuring a gateway on the FortiPAM server

To configuring a gateway on the FortiPAM server:

Go to Secrets > Gateway.
In the Gateways list, select +Create.
The New Gateway window opens.
In Name, enter a name for the gateway.
Ensure that the Status is enabled.
Ensure that Type is Forward.
In Address, enter the IP address of the forward proxy.
This was set up on port1 in Configuring forward gateway on FortiGate.
In Port, enter the gateway port number.
In this example, it is 8443.
This was set up in Configuring a gateway on the FortiPAM server.
Ensure that the SSL Max Version is TLS 1.3 (default).
Ensure that the TCP Forwarding Path is tcp (default). This tells the gateway how to internally process the request from FortiPAM.
Optionally, enter a description.
Click Submit.

Client Certificate is required only when client-cert is enabled in Configuring forward gateway on FortiGate.

CA Certificate is the CA for the FortiGate certificate configured in Configuring forward gateway on FortiGate (ssl-certificate).

If it is not configured, FortiPAM server does not check the FortiGate certificate during the TLS handshake.

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Unified SASE

Single Vendor SASE

Cloud Network Security

Secure Endpoint Connectivity

Web Application / API Protection

Security Operations

Security Operations Automation

Identity

Early Detection & Prevention

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Communication & Surveillance

Unified SASE

Single Vendor SASE

Secure Endpoint Connectivity

Cloud Network Security

Cloud-Native Security

Web Application / API Protection

Security Operations

Security Operations Automation

Endpoint

Data Protection

Identity

Email

Early Detection & Prevention

Expert Services

Edge Firewall

Orchestration & management

SD Branch

Application Delivery

Single Vendor SASE

Secure Endpoint Connectivity

Secure Private Access

Thin Edge

Identity

Application Gateway

Enterprise Asset Management

Endpoint Agent

Agentless Security Posture

Identity

Wireless

Switching

Identity

Privilege Acccess Management

Next Generation Firewall

Orchestration & management

Expert Services

Web Application / API Protection

All

All

Account Management

SAAS Management

SAAS Application Security

Managed Services

Platform as a service (PAAS)

Other SAAS Services

4D Pillars

Cloud

Popular Solutions

All Products

Examples

Configuring a gateway on the FortiPAM server

Configuring a gateway on the FortiPAM server

To configuring a gateway on the FortiPAM server:

Configuring a gateway on the FortiPAM server

Configuring a gateway on the FortiPAM server

To configuring a gateway on the FortiPAM server: