Fortinet black logo

Administration Guide

FortiAuthenticator settings

FortiAuthenticator settings

When checking FortiAuthenticator settings, you should ensure that:

  • There is an authentication client entry for the FortiGate unit (see RADIUS service).
  • The user trying to authenticate has a valid active account that is not disabled, and that the username and password are entered correctly.
  • The user account allows RADIUS authentication if RADIUS is enabled on the FortiGate unit.
  • The FortiGate unit can communicate with FortiAuthenticator, on the required ports:
  • RADIUS Authentication: UDP/1812
  • LDAP: TCP/389
  • The user account exists either:
    • as a local user on the FortiAuthenticator (if using RADIUS authentication),
    • in the local LDAP directory (if using local LDAP authentication),
    • and/or in the remote LDAP directory (if using RADIUS authentication with remote LDAP password validation).
  • The user is a member in the expected user groups and these user groups are allowed to communicate on the authentication client (e.g. the FortiGate).
  • If authentication fails with the log error "bad password", try resetting the password. If this fails, verify that the pre-shared secret is identical on both FortiAuthenticator and the authentication client.

If FortiToken authentication is failing, try the following:

  • Verify that the token is correctly synchronized.
  • Remove the token from the user authentication configuration and verify authentication works when the token is not present.
  • Attempt to log into the FortiAuthenticator with the user credentials.

These steps enable the administrator to identify whether the problem is with the FortiGate unit, the credentials, or the FortiToken.

FortiAuthenticator settings

When checking FortiAuthenticator settings, you should ensure that:

  • There is an authentication client entry for the FortiGate unit (see RADIUS service).
  • The user trying to authenticate has a valid active account that is not disabled, and that the username and password are entered correctly.
  • The user account allows RADIUS authentication if RADIUS is enabled on the FortiGate unit.
  • The FortiGate unit can communicate with FortiAuthenticator, on the required ports:
  • RADIUS Authentication: UDP/1812
  • LDAP: TCP/389
  • The user account exists either:
    • as a local user on the FortiAuthenticator (if using RADIUS authentication),
    • in the local LDAP directory (if using local LDAP authentication),
    • and/or in the remote LDAP directory (if using RADIUS authentication with remote LDAP password validation).
  • The user is a member in the expected user groups and these user groups are allowed to communicate on the authentication client (e.g. the FortiGate).
  • If authentication fails with the log error "bad password", try resetting the password. If this fails, verify that the pre-shared secret is identical on both FortiAuthenticator and the authentication client.

If FortiToken authentication is failing, try the following:

  • Verify that the token is correctly synchronized.
  • Remove the token from the user authentication configuration and verify authentication works when the token is not present.
  • Attempt to log into the FortiAuthenticator with the user credentials.

These steps enable the administrator to identify whether the problem is with the FortiGate unit, the credentials, or the FortiToken.