Authentication

Use this command to configure the authentication options for the GLB settings of the FQDN.

Before you begin:

• You must have read-write permission for global load balancing settings.

Syntax

config global-load-balance setting

set auth-type {none|TCP_MD5SIG|auth_verify}

set password <string>

set ca-verify {enable|disable}

set ca-group <datasource>

set intermediate-ca-group <datasource>

end

auth-type	Select the authentication type: none — No password. TCP_MD5SIG — With password, but cannot be used if NAT is in between the client and server. This is because, when using the TCP MD5SIG authentication in a network with NAT in between, the IP layer is encrypted. So is every packet. Because the IP address will be changed, the encryption check will always fail. auth_verify — The authentication key is sent to the server after a three-way handshake. The key is encrypted and NAT in between will not affect the authentication.
password	The password option is available if auth-type is TCP_MD5SIG or auth_verify. Enter the password to authenticate the key. This password is used for authentication between the GLB and the server. The same password must be set on both, otherwise the two will not be able to synchronize.
ca-verify	Enable/disable the root CA verification when synchronizing the SLB information to the GSLB server.
ca-group	The ca-group option is available if ca-verify is enabled. Select a trusted CA group to verify the peer certificate.
intermediate-ca-group	The intermediate-ca-group option is available if ca-verify is enabled. Select a trusted intermediate CA group to verify the peer certificate.

Example

FortiADC-docs # config global-load-balance setting

FortiADC-docs (setting) # get

password : *

proximity-detect-protocol : icmp

proximity-detect-retry-count : 3

proximity-cache-mask-length : 24

proximity-cache-mask-length6 : 64

proximity-detect-interval : 3

proximity-cache-aging-period : 86400

persistence-mask-length : 24

persistence-mask-length6 : 64

persistence-timeout : 60

set auth-type TCP_MD5SIG

FortiADC-docs (setting) #set password *

FortiADC-docs (setting) # end