Fortinet black logo

Administration Guide

Add an admin profile

Copy Link
Copy Doc ID 825689eb-200d-11e9-b6f6-f8bc1258b856:814925
Download PDF

Add an admin profile

Admin Profiles control permissions for Administrative Users.

  1. Click Users > Admin Profiles.
  2. Click Add. The Add Admin Profile screen appears with the General tab highlighted.
  3. Enter a name for the profile.
  4. Use the table below to configure the new admin profile.
  5. On the Permissions tab note that some permissions are dependent on each other. Refer to the Permissions list for additional information.
  6. Click OK to save.
General tab settings

Field

Definition

Name

Enter a name that describes the profile, such as Librarian or IT Staff.

Logout After ... Minutes of Inactivity

User is logged out after this amount of time has elapsed without any activity in the user interface.

Login Availability

Indicates when users with this profile can log in to FortiNAC. Options include: Always or Specify Time. If you choose Specify Time, user access to FortiNAC is limited to certain times of day and days of the week.

Manage Hosts And Ports

Restricts an Administrative User to a specific set of hosts or ports. The set is defined by host and port groups that are assigned to be managed by a specific group of Administrative Users.

Any Administrative User that has a profile with this option enabled can only view and or modify a subset of the data in FortiNAC. Typically, this type of user would ONLY have the Manage Hosts & Ports permission set on the Permissions tab, therefore, this setting is not used frequently. Default = All.

All—All groups containing hosts and ports can be accessed.

Restrict By Groups—Enables the restriction of Administrative Users to specific hosts and ports.

For an overview and additional setup information see Limit admin access with groups.

Note

User specified note field. This field may contain notes regarding the data conversion from a previous version of FortiNAC for an existing Admin Profile record.

Enable Guest Kiosk

If you enable this mode, the ONLY thing that the Administrative User can access is the self-service Kiosk. Everything else in FortiNAC is disabled.

The Administrative User can log into FortiNAC to provide visitors self-serve account creation through a kiosk. For added security, use a kiosk browser.

See to read the Administrative User’s procedure.

Kiosk Template

Field displays only if Enable Guest Kiosk is selected. Select a Kiosk template for this Admin Profile. All visitors who use the self-service Kiosk when this Administrative User is logged in are assigned this guest template.

Kiosk Welcome
Message

Field displays only if Enable Guest Kiosk is selected. Enter the message that will appear when the kiosk user creates a guest account.

Permissions tab settings

Field

Definition

Landing Page

Indicates the first view displayed when an Admin User with this profile logs into FortiNAC. There are no options displayed in this field until permissions are selected.

Permission Set

Click the arrow next to a permission set to see the Views that can be accessed when this permission set is enabled. For example, if Devices is selected, this profile provides access to the following: CLI Configuration, Device Profiling Rules, L2 Polling, L3 Polling, Locate, Port Changes and Topology

Access

Indicates that the user will have view access to the permission set in the left column. Depending on the permission set, enabling Access automatically enables Add/Modify and/or Delete.

Add/Modify

Indicates that the user will be able to add or modify records in the permission set in the left column.

Delete

Indicates that the user will be able to delete records in the permission set in the left column.

Custom

When Custom is enabled for a permission set an addition tab is displayed. For example, if Custom is enabled for Guest Contractor Accounts a Manage Guests tab is displayed allowing you to configure additional controls for guest account creation.

See Add a guest manager profile for information on the Manage Guest tab.

See Administrative user profiles for device managersfor information on the Profile Devices tab.

Check All
Uncheck All Buttons

Checks or unchecks all permissions.

Specify login availability time

This option allows you to limit access to FortiNAC for an Administrative User based on the time of day and the day of the week. Any Administrative User associated with this profile can only access FortiNAC as specified in the Login Availability field for the Admin Profile.

  1. Click Users > Admin Profiles.
  2. Click select an admin profile and click Modify.
  3. In the Login Availability field, select Specify Time.
  4. In the Time Range section of the Specify Time dialog, enter the From and To times for the time of day that administrative users should be able to access the network.
  5. In the Days of the Week section, select the days during which these users should be allowed to access the network.
  6. Click OK.
Manage guests tab settings

Field

Definition

Guest Account Access

You can give Administrative Users with this profile privileges that allow them to manage all guest contractor accounts, regardless of who created them, only their own accounts, or no accounts.

The privileges include whether the sponsors can add or modify accounts, locate guests or contractors, and view reports.

No—Users can only see guest accounts they create and send credentials to those guests. Users cannot modify or delete any guest accounts.

Own Accounts—Users can see guest accounts they create, send credentials to those guests, and modify or delete their own guest accounts.

All Accounts—User can see all Guest accounts in the database, send credentials to guests and modify or delete any guest accounts.

Account Types

Individual—Sponsor can create single guest accounts. Within the constraints of the template, the sponsor may specify account start and end date. Each account has a unique name and password associated with it.

Bulk—Sponsors may create multiple accounts with unique passwords by importing a bulk account file.

Conference—Sponsors may create any number of conference accounts, or the number may be limited by a template. Conference accounts may be named identically but have a unique password for each attendee, have the same name and password, or have unique names and passwords.

Create Accounts Days in Advance (Maximum)

The maximum number of days in advance this sponsor is allowed to create accounts.

Create Accounts Active For Days (Maximum)

Determines the length of time the guest account remains active in the database.

Allowed Templates

Indicates whether the Administrative User can use all guest templates or only those in the Specify Templates > Selected Templates field. Default = All. Options include:

All Templates—Profile gives the Administrative User access to all templates in the database when creating guest accounts.

Specify Templates—Profile gives the Administrative User access to the templates listed in Selected Templates.

Specify Templates

Allows you to select guest/contractor templates available for Administrative Users with this Admin User Profile. Use the arrows to place the templates needed in the Selected Templates column and the unwanted templates in the Available Templates column.

If All Templates is selected in the Allowed Templates field, all templates are moved to the Selected Templates column and the arrows are hidden.

Available Templates

Shows the templates that have not been selected to be included in this Admin User Profile.

Selected Templates

Shows the templates selected to be included in this Admin User Profile.

Add Icon

Click this button to create a new Guest/Contractor template.

For information on templates,

Modify Icon

Click this button to modify the selected Guest/Contractor template.

For information on templates,

Profile devices tab settings

Field

Definition

Register, Delete, and Disable Profiled Devices

If enabled, the user can register, delete and disable devices that have been profiled by Device Profiler.

Modify Device Rule Confirmation Settings

If enabled, the user can change rule confirmation settings on devices that have been profiled by Device Profiler. Rule confirmation settings control whether or not Device Profiler checks a previously profiled device to determine if it still meets the criteria of the rule that categorized the device.

Manage Profiled Devices Using These Rules

All Rules—includes current rules and any rules created in the future.

Specify Rules—you must choose the rules from the Available Rules field and manually move them to the Specify Rules field.

Available Rules

Shows the existing rules you can select for this profile. Select the rule and click the right arrow to move it to the Selected Rules pane.

Selected Rules

Shows the rules you selected from the Available Rules section. The user can only access the devices associated with the rules in this list.

Add Icon

Click this button to create a new Device Profiling Rule.

For information on rules, see Add or modify rules.

Modify Icon

Click this button to modify the selected Device Profiling Rule.

For information on rules, see Add or modify rules.

Security events tab settings

Note

The Security Events tab is only available when ATR is enabled within your current license package.

Field

Definition

Allow Overriding of Recommended Actions

If enabled, the user can override the associated action when taking action on the alarm.

Allowed Actions for Security Events

All Actions—includes current actions and any actions created in the future.

Specify Actions—you must choose the rules from the Available Actions field and manually move them to the Selected field.

Available Actions

Shows the existing actions you can select for this profile. Select the action and click the right arrow to move it to the Selected Actions pane.

Selected Actions

Shows the actions you selected from the Available Actions section. The user can only complete the actions in this list.

Add an admin profile

Admin Profiles control permissions for Administrative Users.

  1. Click Users > Admin Profiles.
  2. Click Add. The Add Admin Profile screen appears with the General tab highlighted.
  3. Enter a name for the profile.
  4. Use the table below to configure the new admin profile.
  5. On the Permissions tab note that some permissions are dependent on each other. Refer to the Permissions list for additional information.
  6. Click OK to save.
General tab settings

Field

Definition

Name

Enter a name that describes the profile, such as Librarian or IT Staff.

Logout After ... Minutes of Inactivity

User is logged out after this amount of time has elapsed without any activity in the user interface.

Login Availability

Indicates when users with this profile can log in to FortiNAC. Options include: Always or Specify Time. If you choose Specify Time, user access to FortiNAC is limited to certain times of day and days of the week.

Manage Hosts And Ports

Restricts an Administrative User to a specific set of hosts or ports. The set is defined by host and port groups that are assigned to be managed by a specific group of Administrative Users.

Any Administrative User that has a profile with this option enabled can only view and or modify a subset of the data in FortiNAC. Typically, this type of user would ONLY have the Manage Hosts & Ports permission set on the Permissions tab, therefore, this setting is not used frequently. Default = All.

All—All groups containing hosts and ports can be accessed.

Restrict By Groups—Enables the restriction of Administrative Users to specific hosts and ports.

For an overview and additional setup information see Limit admin access with groups.

Note

User specified note field. This field may contain notes regarding the data conversion from a previous version of FortiNAC for an existing Admin Profile record.

Enable Guest Kiosk

If you enable this mode, the ONLY thing that the Administrative User can access is the self-service Kiosk. Everything else in FortiNAC is disabled.

The Administrative User can log into FortiNAC to provide visitors self-serve account creation through a kiosk. For added security, use a kiosk browser.

See to read the Administrative User’s procedure.

Kiosk Template

Field displays only if Enable Guest Kiosk is selected. Select a Kiosk template for this Admin Profile. All visitors who use the self-service Kiosk when this Administrative User is logged in are assigned this guest template.

Kiosk Welcome
Message

Field displays only if Enable Guest Kiosk is selected. Enter the message that will appear when the kiosk user creates a guest account.

Permissions tab settings

Field

Definition

Landing Page

Indicates the first view displayed when an Admin User with this profile logs into FortiNAC. There are no options displayed in this field until permissions are selected.

Permission Set

Click the arrow next to a permission set to see the Views that can be accessed when this permission set is enabled. For example, if Devices is selected, this profile provides access to the following: CLI Configuration, Device Profiling Rules, L2 Polling, L3 Polling, Locate, Port Changes and Topology

Access

Indicates that the user will have view access to the permission set in the left column. Depending on the permission set, enabling Access automatically enables Add/Modify and/or Delete.

Add/Modify

Indicates that the user will be able to add or modify records in the permission set in the left column.

Delete

Indicates that the user will be able to delete records in the permission set in the left column.

Custom

When Custom is enabled for a permission set an addition tab is displayed. For example, if Custom is enabled for Guest Contractor Accounts a Manage Guests tab is displayed allowing you to configure additional controls for guest account creation.

See Add a guest manager profile for information on the Manage Guest tab.

See Administrative user profiles for device managersfor information on the Profile Devices tab.

Check All
Uncheck All Buttons

Checks or unchecks all permissions.

Specify login availability time

This option allows you to limit access to FortiNAC for an Administrative User based on the time of day and the day of the week. Any Administrative User associated with this profile can only access FortiNAC as specified in the Login Availability field for the Admin Profile.

  1. Click Users > Admin Profiles.
  2. Click select an admin profile and click Modify.
  3. In the Login Availability field, select Specify Time.
  4. In the Time Range section of the Specify Time dialog, enter the From and To times for the time of day that administrative users should be able to access the network.
  5. In the Days of the Week section, select the days during which these users should be allowed to access the network.
  6. Click OK.
Manage guests tab settings

Field

Definition

Guest Account Access

You can give Administrative Users with this profile privileges that allow them to manage all guest contractor accounts, regardless of who created them, only their own accounts, or no accounts.

The privileges include whether the sponsors can add or modify accounts, locate guests or contractors, and view reports.

No—Users can only see guest accounts they create and send credentials to those guests. Users cannot modify or delete any guest accounts.

Own Accounts—Users can see guest accounts they create, send credentials to those guests, and modify or delete their own guest accounts.

All Accounts—User can see all Guest accounts in the database, send credentials to guests and modify or delete any guest accounts.

Account Types

Individual—Sponsor can create single guest accounts. Within the constraints of the template, the sponsor may specify account start and end date. Each account has a unique name and password associated with it.

Bulk—Sponsors may create multiple accounts with unique passwords by importing a bulk account file.

Conference—Sponsors may create any number of conference accounts, or the number may be limited by a template. Conference accounts may be named identically but have a unique password for each attendee, have the same name and password, or have unique names and passwords.

Create Accounts Days in Advance (Maximum)

The maximum number of days in advance this sponsor is allowed to create accounts.

Create Accounts Active For Days (Maximum)

Determines the length of time the guest account remains active in the database.

Allowed Templates

Indicates whether the Administrative User can use all guest templates or only those in the Specify Templates > Selected Templates field. Default = All. Options include:

All Templates—Profile gives the Administrative User access to all templates in the database when creating guest accounts.

Specify Templates—Profile gives the Administrative User access to the templates listed in Selected Templates.

Specify Templates

Allows you to select guest/contractor templates available for Administrative Users with this Admin User Profile. Use the arrows to place the templates needed in the Selected Templates column and the unwanted templates in the Available Templates column.

If All Templates is selected in the Allowed Templates field, all templates are moved to the Selected Templates column and the arrows are hidden.

Available Templates

Shows the templates that have not been selected to be included in this Admin User Profile.

Selected Templates

Shows the templates selected to be included in this Admin User Profile.

Add Icon

Click this button to create a new Guest/Contractor template.

For information on templates,

Modify Icon

Click this button to modify the selected Guest/Contractor template.

For information on templates,

Profile devices tab settings

Field

Definition

Register, Delete, and Disable Profiled Devices

If enabled, the user can register, delete and disable devices that have been profiled by Device Profiler.

Modify Device Rule Confirmation Settings

If enabled, the user can change rule confirmation settings on devices that have been profiled by Device Profiler. Rule confirmation settings control whether or not Device Profiler checks a previously profiled device to determine if it still meets the criteria of the rule that categorized the device.

Manage Profiled Devices Using These Rules

All Rules—includes current rules and any rules created in the future.

Specify Rules—you must choose the rules from the Available Rules field and manually move them to the Specify Rules field.

Available Rules

Shows the existing rules you can select for this profile. Select the rule and click the right arrow to move it to the Selected Rules pane.

Selected Rules

Shows the rules you selected from the Available Rules section. The user can only access the devices associated with the rules in this list.

Add Icon

Click this button to create a new Device Profiling Rule.

For information on rules, see Add or modify rules.

Modify Icon

Click this button to modify the selected Device Profiling Rule.

For information on rules, see Add or modify rules.

Security events tab settings

Note

The Security Events tab is only available when ATR is enabled within your current license package.

Field

Definition

Allow Overriding of Recommended Actions

If enabled, the user can override the associated action when taking action on the alarm.

Allowed Actions for Security Events

All Actions—includes current actions and any actions created in the future.

Specify Actions—you must choose the rules from the Available Actions field and manually move them to the Selected field.

Available Actions

Shows the existing actions you can select for this profile. Select the action and click the right arrow to move it to the Selected Actions pane.

Selected Actions

Shows the actions you selected from the Available Actions section. The user can only complete the actions in this list.