Configuring RADIUS authentication

You can configure administrator authentication using a Remote Authentication Dial-In User Service (RADIUS) server.

You can login to FortiDDoS 3 ways:

Local Username, Password, Admin Profile, Trusted hosts (optional)
- No RADIUS required. It is highly recommended that at least one local super_admin_pro(file) is available as well as the admin (globaladmin)/super_admin_profile that cannot be deleted.
- RADIUS is not used.
Local Username, Admin Profile, Trusted hosts (optional) with RADIUS password management and no local password.
No local username or password – RADIUS provides login credentials, with Admin Profile and Trusted Hosts in VSAs. Correct credentials with no matching VSAs results in a login with no access.

After you complete the RADIUS server configuration and enable it, there are two options:

If no username/password is found on the system, RADIUS is Queried
If RADIUS is used only for password management (no VSAs), create a new Administrator, complete Name, Admin Profile and Trusted Hosts (optional) fields, then change the Strategy field to RADIUS. System will check RADIUS for password matching the username and will apply the Admin Profile and check Trusted Hosts before granting access.

Note 1: Any access profile (read-only, read-write or none combinations) is usable for GUI users. CLI users must have “super_admin_prof” Profile or they will be rejected.

FortiDDoS-F-series supports Two Factor Authentication (2FA) for RADIUS.

You may adjust the time FortiDDoS waits for a response from your RADIUS server or authentication proxy in the System > Admin > Settings tab.

You may adjust the time FortiDDoS waits for a response from your RADIUS server or authentication proxy in System > Admin > Settings tab.

Before you begin:

You must have Read-Write permission for System settings.

To configure a RADIUS server:

Go to System > Authentication > RADIUS.
Complete the configuration as described in the table below.
Save the configuration.

RADIUS server settings

Settings	Guidelines
Status	Enable/disable RADIUS Authentication. This must be enabled to configure the RADIUS Server Configuration settings.
Primary Server Name/IP	IP address or FQDN of the primary RADIUS server.
Primary Server Secret	RADIUS server shared secret – maximum 116 characters (special characters are allowed).
Secondary Server Name/IP	Optional. IP address or FQDN of a backup RADIUS server.
Secondary Server Secret	Optional. RADIUS server shared secret – maximum 116 characters (special characters are allowed).
Port	RADIUS port. Usually, this is 1812.
Authentication Protocol	Auto—If you leave this default value, the system uses MSCHAP2. PAP—Password Authentication Protocol CHAP—Challenge Handshake Authentication Protocol (defined in RFC 1994) MSCHAP—Microsoft CHAP (defined in RFC 2433) MSCHAP2—Microsoft CHAP version 2 (defined in RFC 2759)
Test Connectivity
Test Connectivity	Select to test connectivity using a test username and password specified next. Click the Test button before you save the configuration.
Username	Username for the connectivity test.
Password	Corresponding password.

RADIUS server configuration page

RADIUS server configuration guidelines

config system authentication radius  
  set state {enable|disable}
  set primary-server <ip|domain>
  set primary-secret <string>
  set backup-server <ip|domain>
  set backup-secret <string>
  set port <port>
  set authprot {auto|chap|mschap|mschapv|pap}
end

RADIUS Vendor Specific Attributes (VSAs)

FortiDDoS F-series VSAs:

Fortinet-FDD-Access-Profile 30 string
Fortinet-FDD-Trusted-Hosts 31 string

are included in the file “dictionary.fortinet” included in every FortiCare firmware Release download folder. Other “Fortinet-FDD…” and non-FortiDDoS attributes are not supported by FortiDDoS F-Series and ignored if sent from the RADIUS server. Thus, the same RADIUS server and VSAs can support FortiDDoS-B, E and F platforms simultaneously.