Configuring RADIUS authentication

You can configure administrator authentication using a Remote Authentication Dial-In User Service (RADIUS) server.

After you complete the RADIUS server configuration and enable it, you can select it when you create an administrator user on the System > Admin > Administrator page. When RADIUS is selected, no local password option is available.

You can also specify the trusted host list and Admin (access) profile for that user. For more details about creating a user profile, see here.

Note 1: Any access profile (read-only, read-write or none combinations) is usable for GUI users. CLI users must have “super_admin_prof” Profile or they will be rejected.

Note 2: FortiDDoS-F does not support RADIUS VSAs. A local username is required for GUI and CLI access. Anyone attempting to access the system without a local username, but valid RADIUS credentials, will be refused via CLI. An anomaly in the GUI code will allow non-local valid users access to the GUI but pages will be empty of any configuration information and there will be no write access.

Once RADIUS is enabled, a series of checks is performed locally and at the RADIUS server level. The diagram below illustrates the RADIUS authentication flow.

FortiDDoS-F-series supports Two Factor Authentication (2FA) for RADIUS. You may adjust the time FortiDDoS waits for a response from your RADIUS server or authentication proxy in the System > Admin > Settings tab.

You may adjust the time FortiDDoS waits for a response from your RADIUS server or authentication proxy in System > Admin > Settings tab.

Before you begin:

• You must have Read-Write permission for System settings.

To configure a RADIUS server:

1. Go to System > Authentication > RADIUS.
2. Complete the configuration as described in the table below.
3. Save the configuration.

RADIUS server settings

Settings	Guidelines
Status	Enable/disable RADIUS Authentication. This must be enabled to configure the RADIUS Server Configuration settings.
Primary Server Name/IP	IP address or FQDN of the primary RADIUS server.
Primary Server Secret	RADIUS server shared secret – maximum 116 characters (special characters are allowed).
Secondary Server Name/IP	Optional. IP address or FQDN of a backup RADIUS server.
Secondary Server Secret	Optional. RADIUS server shared secret – maximum 116 characters (special characters are allowed).
Port	RADIUS port. Usually, this is 1812.
Authentication Protocol	Auto—If you leave this default value, the system uses MSCHAP2. PAP—Password Authentication Protocol CHAP—Challenge Handshake Authentication Protocol (defined in RFC 1994) MSCHAP—Microsoft CHAP (defined in RFC 2433) MSCHAP2—Microsoft CHAP version 2 (defined in RFC 2759)
Test Connectivity
Test Connectivity	Select to test connectivity using a test username and password specified next. Click the Test button before you save the configuration.
Username	Username for the connectivity test.
Password	Corresponding password.

config system authentication radius set state {enable|disable} set primary-server <ip|domain> set primary-secret <string> set backup-server <ip|domain> set backup-secret <string> set port <port> set authprot {auto|chap|mschap|mschapv|pap} end