Configuring RADIUS administrator accounts

You may want to configure administrator authentication using RADIUS. First create a user group. Once the user group is defined (and the appropriate settings are configured on your RADIUS server), you can create a RADIUS administrative user.

To create a user group:

1. Go to User & Authentication > User Groups, and click +Create New.
2. Set Name to Admin.
3. Set Type to Firewall.
4. Add a remote group:
   1. Click Add. The Add Group Match pane is displayed.
   2. Set Remote Server to RADIUS.
   3. Set Groups to Specify.
   4. Enter FirewallAdmin.
   5. Click OK. The remote group is displayed.
5. Click OK to save the user group.

To create a RADIUS administrator:

1. Go to System > Administrators, and click Create New > Administrator.
2. Enter a name, such as FWAdmin, and select Match a user on a remote server group.
3. Enter a Backup Password. This password is only used when the FortiGate cannot connect to the RADIUS server.
4. Set Administrator profile to super_admin.
5. Set Remote User Group to Admin.
6. Enable Two-factor Authentication.

   Use caution when implementing MFA on all administrator accounts. If you are unable to provide the token code for all accounts, you may have to reset your FortiGate, and reload your configuration from backup. As a precaution, consider creating an administrative account with a long and complex password. Write down the password, and keep it in a secure location. Then only use the password if you are locked out from administrator accounts that use MFA.

7. Enable Restrict login to trusted hosts.
8. Click OK.