Fortinet Document Library

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

Administration Guide

General

To configure general account policy settings, go to Authentication > User Account Policies > General.

Configure the following settings:

PCI DSS 3.2 two-factor authentication Enable to always collect all authentication factors before indicating a success or failure.

Enhanced cryptography for storage of local user passwords

When disabled, FortiAuthenticator uses AES256 encryption for local user passwords.

When enabled, local user passwords are hashed using bcrypt.

With enhanced cryptography, cleartext passwords can no longer be recovered, and authentication requests requiring cleartext passwords for validation will fail. Enhanced cryptography can be disabled within 30 days of being enabled. After 30 days it cannot be disabled. FortiAuthenticator sends an email reminder to the administrator before the end of the 30-day period.

Local admin passwords are always hashed using bcrypt.

Expire device login after Login session timeout for Windows machine authentication via 802.1X.
Automatically purge disabled user accounts

Enable to automatically purge disabled user accounts. Select the frequency of the purge in the Frequency field: Hourly, Daily, Weekly, or Monthly. Enter the time of the purge in the Time field: Now to set the time to the current time, or select the clock icon to choose a time: Now, Midnight, 6 a.m., or Noon.

Purge users that are disabled due to the following reasons Set the reason for purging disabled users: Manually disabled, Login inactivity, or Account expired.
Discard stale RADIUS authentication requests Enable to select a time after which RADIUS authentication requests are considered stale and are discarded, from 3 - 360 seconds (or six minutes). The default is set to 8 seconds.
Expire inactive RADIUS accounting session after Enter a time after which RADIUS accounting sessions timeout, from 5 to 1440 minutes (or five minutes to one day). The default is set to 60 minutes.

General

To configure general account policy settings, go to Authentication > User Account Policies > General.

Configure the following settings:

PCI DSS 3.2 two-factor authentication Enable to always collect all authentication factors before indicating a success or failure.

Enhanced cryptography for storage of local user passwords

When disabled, FortiAuthenticator uses AES256 encryption for local user passwords.

When enabled, local user passwords are hashed using bcrypt.

With enhanced cryptography, cleartext passwords can no longer be recovered, and authentication requests requiring cleartext passwords for validation will fail. Enhanced cryptography can be disabled within 30 days of being enabled. After 30 days it cannot be disabled. FortiAuthenticator sends an email reminder to the administrator before the end of the 30-day period.

Local admin passwords are always hashed using bcrypt.

Expire device login after Login session timeout for Windows machine authentication via 802.1X.
Automatically purge disabled user accounts

Enable to automatically purge disabled user accounts. Select the frequency of the purge in the Frequency field: Hourly, Daily, Weekly, or Monthly. Enter the time of the purge in the Time field: Now to set the time to the current time, or select the clock icon to choose a time: Now, Midnight, 6 a.m., or Noon.

Purge users that are disabled due to the following reasons Set the reason for purging disabled users: Manually disabled, Login inactivity, or Account expired.
Discard stale RADIUS authentication requests Enable to select a time after which RADIUS authentication requests are considered stale and are discarded, from 3 - 360 seconds (or six minutes). The default is set to 8 seconds.
Expire inactive RADIUS accounting session after Enter a time after which RADIUS accounting sessions timeout, from 5 to 1440 minutes (or five minutes to one day). The default is set to 60 minutes.