Configuring the FortiAuthenticator

To create the RADIUS client:

1. On the FortiAuthenticator, go to Authentication > RADIUS Service > Clients, and select Create New.
2. Enter a Name, the IP address of the FortiGate, and set a Secret.
   The secret is a pre-shared secure password that the FortiGate will use to authenticate to the FortiAuthenticator.

   

To create the RADIUS policy:

1. Go to Authentication > RADIUS Service > Policies, and select Create New.
2. Enter the RADIUS policy name, description, and select the FortiGate RADIUS client.
3. Do not configure RADIUS attribute criteria.
4. Choose Password/OTP authentication as the authentication type and enable all EAP types.
   
5. Choose a username format (in this example: username@realm), select the Local realm.
   Add the employees user group as a filter.
   
6. Set the authentication method to Password only authentication.
7. Review the RADIUS response, and click Save and Exit.

To create the local user accounts:

1. Next go to Authentication > User Management > Local Users and create local user accounts as needed.



2. For each user, add the following RADIUS attributes which specify the VLAN information to be sent to the FortiGate.

The Tunnel-Private-Group-Id attribute specifies the VLAN ID.

In this example, jsmith is assigned VLAN 100 and twhite is assigned VLAN 200.