Administrators can use remote authentication, such as LDAP, to connect to the FortiGate.
Setting up remote authentication for administrators includes the following steps:
- Configuring the LDAP server
- Adding the LDAP server to a user group
- Configuring the administrator account
- Go to User & Authentication > LDAP Servers and click Create New.
- Enter the server Name and Server IP/Name.
- Enter the Common Name Identifier and Distinguished Name.
- Set the Bind Type to Regular and enter the Username and Password.
- Click OK.
config user ldap edit <name> set server <server_ip> set cnid "cn" set dn "dc=XYZ,dc=fortinet,dc=COM" set type regular set username "cn=Administrator,dc=XYA, dc=COM" set password <password> next end
After configuring the LDAP server, create a user group that includes that LDAP server.
- Go to User & Authentication > User Groups and click Create New.
- Enter a Name for the group.
- In the Remote groups section, select Create New.
- Select the Remote Server from the dropdown list.
- Click OK.
config user group edit <name> set member <ldap_server_name> next end
After configuring the LDAP server and adding it to a user group, create a new administrator. For this administrator, instead of entering a password, use the new user group for authentication.
- Go to System > Administrators and click Create New > Administrator.
- Specify the Username.
- Set Type to Match all users in a remote server group.
- In Remote User Group, select the user group you created.
- Select an Administrator Profile.
- Click OK.
config system admin edit <name> set remote-auth enable set accprofile super_admin set wildcard enable set remote-group <ldap_group_name> next end
The Match all users in a remote server group option acts as a wildcard for matching any users against the remote server group. The Match a user on a remote server group option only matches the username defined to match against the remote server group, which is the equivalent of using
Administrator accounts can use different methods for authentication, including RADIUS, TACACS+, and PKI.
To use a RADIUS server to authenticate administrators, you must:
- Configure the FortiGate to access the RADIUS server.
- Create the RADIUS user group.
- Configure an administrator to authenticate with a RADIUS server.
To use a TACACS+ server to authenticate administrators, you must:
- Configure the FortiGate to access the TACACS+ server.
- Create a TACACS+ user group.
- Configure an administrator to authenticate with a TACACS+ server.
To use PKI authentication for an administrator, you must:
- Configure a PKI user.
- Create a PKI user group.
- Configure an administrator to authenticate with a PKI certificate.
There is an optional setting that restricts logins from local administrator accounts when remote servers are available. This is disabled by default, but can be enabled globally. This option only works when all configured remote servers are down.
config system global set admin-restrict-local enable end