User & Authentication

In User & Authentication, you can control network access for different users and devices in your network. FortiGate authentication controls system access by user group. By assigning individual users to the appropriate user groups you can control each user’s access to network resources. You can define local users and peer users on the FortiGate unit. You can also define user accounts on remote authentication servers and connect them to FortiOS.

When configuring an LDAP connection to an Active Directory server, an administrator must provide Active Directory user credentials. To secure this connection, use LDAPS on both the Active Directory server and FortiGate. See Configuring an LDAP server and Configuring client certificate authentication on the LDAP server. Apply the principle of least privilege. For the LDAP regular bind operation, do not use credentials that provide full administrative access to the Windows server when using credentials. See Configuring least privileges for LDAP admin account authentication in Active Directory. To secure RADIUS connections, consider using RADSEC over TLS instead. See Configuring a RADSEC client.

You can control network access for different device types in your network by doing the following:

• Identifying and monitoring the types of devices connecting to your network

• Using MAC address based access control to allow or deny individual devices

• Using Telemetry data received from FortiClient endpoints to construct a policy to deny access to endpoints with known vulnerabilities or to quarantine compromised endpoints

The following sections provide information about users and devices:

• User definition, groups, and settings

• LDAP servers

• RADIUS servers

• SAML

• TACACS+ servers

• FortiTokens

• PKI

• FSSO

• Include usernames in logs