Configuring a RADIUS server

A RADIUS server can be configured in the GUI by going to User & Authentication > RADIUS Servers, or in the CLI under config user radius.

Basic configuration

The following table summarizes the common RADIUS settings that can be configured in the GUI and CLI.

GUI field	CLI setting	Description
Name	edit <name>	Define the RADIUS server object within FortiOS.
Authentication method	set auth-type {auto | ms_chap_v2 | ms_chap | chap | pap}	Specify the authentication method, or select Default/auto to negotiate PAP, MSCHAP_v2, and CHAP in that order.
NAS IP	set nas-ip <IPv4_address>	Optional setting, also known as Calling-Station-Id. Specify the IP address the FortiGate uses to communicate with the RADIUS server. If left unconfigured, the FortiGate will use the IP address of the interface that communicates with the RADIUS server.
Include in every user group	set all-usergroup {enable | disable}	Optional setting to add the RADIUS server to each user group. This allows each user group to try and authenticate users against the RADIUS server if local authentication fails.
Primary Server
IP/Name	set server <string>	Enter the IP address or resolvable FQDN of the RADIUS server.
Secret	set secret <password>	Enter the password used to connect to the RADIUS server.

There is an option in the GUI to configure a second server, and a third server can be configured in the CLI (see Using multiple RADIUS servers).

Advanced settings

Advanced settings for RADIUS servers can be configured in the CLI. The following are some commonly used settings.

To edit the port used to connect with the RADIUS server:

config system global
    set radius-port <integer> 
end

To edit the default setting for password encoding and username case sensitivity:

config user radius
    edit <name>
        set password-encoding {auto | ISO-8859-1}
        set username-case-sensitive {enable | disable}
    next
end

password-encoding {auto | ISO-8859-1}	Set the password encoding to use the original encoding or ISO-8859-1 (default = auto). The auth-type must be auto or pap to change this setting.
username-case-sensitive {enable | disable}	Enable/disable case sensitive usernames (default = disable).

When connecting to RADIUS over UDP, it is recommended to ensure the FortiGate and RADIUS connection passes through a trusted network or the connection passes through an encrypted tunnel over untrusted networks. If the traffic must pass through an untrusted network without going through an encrypted tunnel, consider upgrading to FortiOS 7.4.0 or later, where RADSEC over TLS is supported as a transport protocol.