Fortinet black logo

CLI Reference

user

user

Use config user to configure:

  • external authentication servers including Windows Active Directory or other Directory Service servers
  • user accounts and user groups for firewall policy authentication, SSL VPN authentication, administrator authentication and some types of VPN authentication
  • device detection
  • peers/peer groups for IPSec VPN and PKI user authentication.

Configuring users for authentication

This command covers two types of user configuration:

• users authenticated by password

• users, sites or computers (peers) authenticated by certificate

Configuring users for password authentication

You need to set up authentication in the following order:

  1. If external authentication is needed, configure the required servers.
  1. Configure local user identities.

For each user, you can choose whether the FortiGate unit or an external authentication server verifies the password.

  1. Create user groups.

Add local users to each user group as appropriate. You can also add an authentication server to a user group. In this case, all users in the server’s database can authenticate to the FortiGate unit.

Configuring peers for certificate authentication

If your FortiGate unit will host IPSec VPNs that authenticate clients using certificates, you need to prepare for certificate authentication as follows:

  1. Import the CA certificates for clients who authenticate with a FortiGate unit VPN using certificates.
  1. Enter the certificate information for each VPN client (peer).
  1. Create peer groups, if you have VPNs that authenticate by peer group. Assign the appropriate peers to each peer group.

This section includes syntax for the following commands:

user

Use config user to configure:

  • external authentication servers including Windows Active Directory or other Directory Service servers
  • user accounts and user groups for firewall policy authentication, SSL VPN authentication, administrator authentication and some types of VPN authentication
  • device detection
  • peers/peer groups for IPSec VPN and PKI user authentication.

Configuring users for authentication

This command covers two types of user configuration:

• users authenticated by password

• users, sites or computers (peers) authenticated by certificate

Configuring users for password authentication

You need to set up authentication in the following order:

  1. If external authentication is needed, configure the required servers.
  1. Configure local user identities.

For each user, you can choose whether the FortiGate unit or an external authentication server verifies the password.

  1. Create user groups.

Add local users to each user group as appropriate. You can also add an authentication server to a user group. In this case, all users in the server’s database can authenticate to the FortiGate unit.

Configuring peers for certificate authentication

If your FortiGate unit will host IPSec VPNs that authenticate clients using certificates, you need to prepare for certificate authentication as follows:

  1. Import the CA certificates for clients who authenticate with a FortiGate unit VPN using certificates.
  1. Enter the certificate information for each VPN client (peer).
  1. Create peer groups, if you have VPNs that authenticate by peer group. Assign the appropriate peers to each peer group.

This section includes syntax for the following commands: