<profile_name>

Enter the name of the profile.

To view a list of existing entries, enter a question mark ( ? ).

access-override-attribute <attribute_int>

Enter the attribute ID of a vendor for remote access permission override. The attribute should hold an access profile name that exists on FortiMail. The default ID is 6, which is Fortinet-Access-Profile.

access-override-vendor <vendor_int>

Enter the vendor’s registered RADIUS ID for remote access permission override. The default ID is 12356, which is Fortinet.

access-override {enable | disable}

Enable to override the access profile you specify when you add an administrator with the value of the remote attribute returned from the RADIUS server, if the returned value matches an existing access profile.

auth-prot {auto | chap | mschap | mschap2 | pap}

Select an authentication method that the RADIUS server supports, either:

• auto: Negotiate automatically by preferring password authentication, Microsoft challenge handshake V2, and then challenge handshake, in that order.

• pap: Password authentication.

• chap: Challenge handshake authentication.

• mschap: Microsoft Challenge Handshake Authentication.

• mschap2: Microsoft Challenge Handshake Authentication V2.

auth-type {auto | cram-md5 | digest-md5 | login | ntlm | plain}

Select an authentication mechanism. For details, seethe relevant RFCs.

This setting is ignored if option {ssl secure tls senddomain} does not include secure.

ca-cert <ca_name>

Select the name of the certificate authority (CA) certificate that will be used to validate the signature on the RADIUS server's certificate. For details, see system certificate ca.

This setting is only available if transport-protocol {tls | tcp | udp} is tls.

domain-override-attribute <attribute_int>

Enter the attribute ID of a vendor for remote domain override. The attribute should hold a domain name that exists on FortiMail. The default ID is 3, which is Fortinet-Vdom-Name.

comment "<comment_str>"

Enter a description or comment.

domain-override-vendor <vendor_int>

Enter the vendor’s registered RADIUS ID for remote domain override. The default ID is 12356, which is Fortinet.

domain-override {enable | disable}

Enable to override the domain you specify when you add an administrator with the value of the remote attribute returned from the RADIUS server, if the returned value matches an existing protected domain.

nas-ip <FortiMail_ipv4>

Enter the NAS IP address, also known as Called-Station-ID (for more information about RADIUS Attribute 31, see RFC 2548 Microsoft Vendor-specific RADIUS Attributes).

If you do not enter an IP address, FortiMail uses the IP address of the interface that communicates with the RADIUS server.

option {ssl secure tls senddomain}

If you want to enable any of the following options, enter them in a space-delimited list:

• senddomain: Enable if the authentication server requires that users log in with both the user name and the domain (for example, user1@example.com, not only user1).

• secure: Enable if the authentication server supports or requires encrypted passwords. Then select the algorithm in auth-type {auto | cram-md5 | digest-md5 | login | ntlm | plain}.

  Caution: Only the password is encrypted by this setting. It does not authenticate the server's identity nor encrypt the entire connection, and therefore does not provide privacy and tamper-proofing of the results. Other data in the query still may be clear text (unencrypted). If the query occurs over untrusted networks such as the Internet, you should also use ssl and/or tls.

• ssl: Enable if the authentication server supports secure socket layers (SSL) and/or transport layer security (TLS) for a secure connection.

  To establish a secure connection, FortiMail must be able to validate the CA signature on the authentication server's certificate. For details, see system certificate ca.

• tls: Enable if the authentication server supports STARTTLS to try to convert an unsecured connection to a secure connection.

For ssl and tls, see also STARTTLS vs. SSL/TLS differences on FortiMail.

port <port_int>

Enter the port number on which the authentication server listens.

FortiMail uses IANA standard port numbers by default. See the default port numbers in the FortiMail Administration Guide.

secret <password_str>

Enter the password for the RADIUS server.

send-domain {enable | disable}

Enable if the RADIUS server requires both the user name and the domain when authenticating.

server {<fqdn_str> | <host_ipv4>}

Enter the IP address or fully qualified domain name (FQDN) of an authentication server.

transport-protocol {tls | tcp | udp}

Select the protocol that the authentication server uses, either:

• tls: TCP connection over TLS 1.2 for secure RADIUS (also called RadSec).

  To establish a secure connection, FortiMail must be able to validate the CA signature on the authentication server's certificate. For details, see system certificate ca.

  Currently mutual authentication is not supported: FortiMail validates the RADIUS server's certificate, but does not send its own local certificate. Therefore the RADIUS server must not require client certificate validation.

• tcp: Reliable transport of queries via a TCP connection.

• udp: Queries sent via a UDP session.

Caution: Do not select UDP or TCP if queries occur over untrusted networks such as the Internet. They are not secure connections, and do not provide encryption nor authentication of the server's identity. Attackers could use this to gain unauthorized access.