Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • Handbook

    Home FortiADC 7.1.2 Handbook
    7.1.2
    7.4.5
    7.4.4
    7.4.3
    7.4.2
    7.4.1
    7.4.0
    7.2.7
    7.2.6
    7.2.5
    7.2.4
    7.2.3
    7.2.2
    7.2.1
    7.2.0
    7.1.4
    7.1.3
    7.1.2
    7.1.1
    7.1.0
    7.0.5
    7.0.4
    7.0.3
    7.0.2
    7.0.1
    7.0.0
    6.2.6
    6.2.5
    6.2.4
    6.2.3
    6.2.2
    6.2.1
    6.2.0
    6.1.6
    6.1.5
    6.1.4
    6.1.3
    6.1.2
    6.1.1
    6.1.0
    6.0.1
    6.0.0
    5.4.3
    5.4.2
    5.4.1
    5.4.0
    5.3.6
    5.3.5
    5.3.4
    5.3.3
    5.3.2
    5.3.1
    5.3.0
    5.2.7

    Configure access profiles

    Configure access profiles

    Access profiles provision permissions to roles. The following permissions can be assigned:

    • Read (view access)
    • Read-Write (view, change, and execute access)
    • No access

    When an administrator has only read access to a feature, the administrator can access the web UI page for that feature, and can use the get and show CLI command for that feature, but cannot make changes to the configuration.

    In larger companies where multiple administrators divide the share of work, access profiles often reflect the specific job that each administrator does (“role”), such as account creation or log auditing. Access profiles can limit each administrator account to their assigned role. This is sometimes called role-based access control (RBAC).

    Areas of control in access profiles lists the administrative areas that can be provisioned. If you provision read access, the role can view the web UI menu (or issue a CLI get command). If you provision read-write access, the role can save configuration changes (or issue a CLI set command).

    For complete access to all commands and abilities, you must log in with the administrator account named admin.

    Areas of control in access profiles
    Web UI Menus CLI Commands

    System

    config system

    diagnose hardware

    diagnose sniffer

    diagnose system

    execute date

    execute ping

    execute ping-options

    execute traceroute

    Router

    config router

    Server Load Balance

    config load-balance

    Link Load Balance

    config link-load-balance

    Global Load Balance

    config global-dns-server

    config global-load-balance

    Security

    config firewall

    config security waf

    Log & Report

    config log

    config report

    execute rebuild-db

    * For each config command, there is an equivalent get/show command. The config commands require write permission. The get/show commands require read permission.

    Before you begin:

    • You must have Read-Write permission for System settings.
    To configure administrator profiles:
    1. Click System > Administrator.
    2. Click the Access Profile tab.
    3. Click Create New to display the configuration editor.
    4. Complete the configuration as described in Configure access profiles.
    5. Click Save.

    Access profile configuration
    Settings Guidelines

    Name

    Specify a name for the access profile configuration. Valid characters are A-Z, a-z, 0-9, _, and -. No spaces.

    System

    Select one of the following:

    • None—Do not provision access for the menu.
    • Read Only—Provision ready-only access.
    • Read-Write—Enable the role to make changes to the configuration.

    Networking

    Select one of the following:

    • None—Do not provision access for the menu.
    • Read Only—Provision ready-only access.
    • Read-Write—Enable the role to make changes to the configuration.

    User

    Select one of the following:

    • None—Do not provision access for the menu.
    • Read Only—Provision ready-only access.
    • Read-Write—Enable the role to make changes to the configuration.

    Server Load Balance

    Select one of the following:

    • None—Do not provision access for the menu.
    • Read Only—Provision ready-only access.
    • Read-Write—Enable the role to make changes to the configuration.

    Link Load Balance

    Select one of the following:

    • None—Do not provision access for the menu.
    • Read Only—Provision ready-only access.
    • Read-Write—Enable the role to make changes to the configuration.

    Global Load Balance

    Select one of the following:

    • None—Do not provision access for the menu.
    • Read Only—Provision ready-only access.
    • Read-Write—Enable the role to make changes to the configuration.

    Security

    Select one of the following:

    • None—Do not provision access for the menu.
    • Read Only—Provision ready-only access.
    • Read-Write—Enable the role to make changes to the configuration.

    Log & Report

    Select one of the following:

    • None—Do not provision access for the menu.
    • Read Only—Provision ready-only access.
    • Read-Write—Enable the role to make changes to the configuration.

    Shared Resource

    For each category, set the permission:

    • None—Do not provision access for the menu.
    • Read Only—Provision ready-only access.
    • Read-Write—Enable the role to make changes to the configuration.

    The super_admin_prof access profile, a special access profile assigned to the admin account and required by it, appears in the list of access profiles. It exists by default and cannot be changed or deleted. The profile has permissions similar to the UNIX root account.
    Previous
    Next

    Configure access profiles

    Configure access profiles

    Access profiles provision permissions to roles. The following permissions can be assigned:

    • Read (view access)
    • Read-Write (view, change, and execute access)
    • No access

    When an administrator has only read access to a feature, the administrator can access the web UI page for that feature, and can use the get and show CLI command for that feature, but cannot make changes to the configuration.

    In larger companies where multiple administrators divide the share of work, access profiles often reflect the specific job that each administrator does (“role”), such as account creation or log auditing. Access profiles can limit each administrator account to their assigned role. This is sometimes called role-based access control (RBAC).

    Areas of control in access profiles lists the administrative areas that can be provisioned. If you provision read access, the role can view the web UI menu (or issue a CLI get command). If you provision read-write access, the role can save configuration changes (or issue a CLI set command).

    For complete access to all commands and abilities, you must log in with the administrator account named admin.

    Areas of control in access profiles
    Web UI Menus CLI Commands

    System

    config system

    diagnose hardware

    diagnose sniffer

    diagnose system

    execute date

    execute ping

    execute ping-options

    execute traceroute

    Router

    config router

    Server Load Balance

    config load-balance

    Link Load Balance

    config link-load-balance

    Global Load Balance

    config global-dns-server

    config global-load-balance

    Security

    config firewall

    config security waf

    Log & Report

    config log

    config report

    execute rebuild-db

    * For each config command, there is an equivalent get/show command. The config commands require write permission. The get/show commands require read permission.

    Before you begin:

    • You must have Read-Write permission for System settings.
    To configure administrator profiles:
    1. Click System > Administrator.
    2. Click the Access Profile tab.
    3. Click Create New to display the configuration editor.
    4. Complete the configuration as described in Configure access profiles.
    5. Click Save.

    Access profile configuration
    Settings Guidelines

    Name

    Specify a name for the access profile configuration. Valid characters are A-Z, a-z, 0-9, _, and -. No spaces.

    System

    Select one of the following:

    • None—Do not provision access for the menu.
    • Read Only—Provision ready-only access.
    • Read-Write—Enable the role to make changes to the configuration.

    Networking

    Select one of the following:

    • None—Do not provision access for the menu.
    • Read Only—Provision ready-only access.
    • Read-Write—Enable the role to make changes to the configuration.

    User

    Select one of the following:

    • None—Do not provision access for the menu.
    • Read Only—Provision ready-only access.
    • Read-Write—Enable the role to make changes to the configuration.

    Server Load Balance

    Select one of the following:

    • None—Do not provision access for the menu.
    • Read Only—Provision ready-only access.
    • Read-Write—Enable the role to make changes to the configuration.

    Link Load Balance

    Select one of the following:

    • None—Do not provision access for the menu.
    • Read Only—Provision ready-only access.
    • Read-Write—Enable the role to make changes to the configuration.

    Global Load Balance

    Select one of the following:

    • None—Do not provision access for the menu.
    • Read Only—Provision ready-only access.
    • Read-Write—Enable the role to make changes to the configuration.

    Security

    Select one of the following:

    • None—Do not provision access for the menu.
    • Read Only—Provision ready-only access.
    • Read-Write—Enable the role to make changes to the configuration.

    Log & Report

    Select one of the following:

    • None—Do not provision access for the menu.
    • Read Only—Provision ready-only access.
    • Read-Write—Enable the role to make changes to the configuration.

    Shared Resource

    For each category, set the permission:

    • None—Do not provision access for the menu.
    • Read Only—Provision ready-only access.
    • Read-Write—Enable the role to make changes to the configuration.

    The super_admin_prof access profile, a special access profile assigned to the admin account and required by it, appears in the list of access profiles. It exists by default and cannot be changed or deleted. The profile has permissions similar to the UNIX root account.
    Previous
    Next