Fortinet black logo

Administration Guide

Manage policies

Copy Link
Copy Doc ID 1ce38eeb-8119-11eb-9995-00505692583a:677488
Download PDF

Manage policies

Create authentication policies to assign an authentication configuration when a host requires network access. Policies are selected for a connecting host by matching host and user data to the criteria defined in the associated user/host profile. The first policy that matches the host and user data is assigned.

Note

If the host does not match any policy, it is assigned the default authentication method configured in the Portal, guest template, or Persistent Agent Credential Configuration.

If you create a user/host profile with fields Where (Location) set to Any, Who/What by Group set to Any, Who/What by Attribute left blank and When set to always, it matches ALL users and hosts. This is essentially a Catch All profile. If this user/host profile is used in a policy, all policies below that policy are ignored when assigning a policy to a user or a host. To highlight this, policies below the policy with the catch all profile are grayed out and have a line through the data.

The best way to use a Catch All profile is to create a general policy with that profile and place it last in the list of policies.

Authentication policies can be accessed from Policy & Objects > Authentication Policy.

Settings

An empty field in a column indicates that the option has not been set.

Field

Definition

Rank Buttons

Moves the selected policy up or down in the list. Host connections are compared to Policies in order by rank.

Set Rank Button

Allows you to type a different rank number for a selected policy and immediately move the policy to that position. In an environment with a large number of policies this process is faster than using the up and down Rank buttons.

Table columns

Rank

Policy's rank in the list of policies. Rank controls the order in which host connections are compared to Policies.

Name

User defined name for the policy.

Authentication
Configuration

Contains the configuration for the authentication policy that will be assigned if this authentication policy matches the connecting host.
See Authentication configurations

User/Host Profile

Contains the required criteria for a connecting host, such as connection location, host or user group membership, host or user attributes or time of day. Host connections that match the criteria within the user/host profile are assigned the associated authentication configuration. See User/host profiles.

Note

User specified note field.

Last Modified By

User name of the last user to modify the policy.

Last Modified Date

Date and time of the last modification to this policy.

Right click options

Delete

Deletes the selected authentication policy.

Modify

Opens the modify authentication policy window for the selected policy.

Show Audit Log

Opens the admin auditing log showing all changes made to the selected item.

For information about the admin auditing log, see Audit Logs.

Note

You must have permission to view the admin auditing log. See Add an administrator profile.

Manage policies

Create authentication policies to assign an authentication configuration when a host requires network access. Policies are selected for a connecting host by matching host and user data to the criteria defined in the associated user/host profile. The first policy that matches the host and user data is assigned.

Note

If the host does not match any policy, it is assigned the default authentication method configured in the Portal, guest template, or Persistent Agent Credential Configuration.

If you create a user/host profile with fields Where (Location) set to Any, Who/What by Group set to Any, Who/What by Attribute left blank and When set to always, it matches ALL users and hosts. This is essentially a Catch All profile. If this user/host profile is used in a policy, all policies below that policy are ignored when assigning a policy to a user or a host. To highlight this, policies below the policy with the catch all profile are grayed out and have a line through the data.

The best way to use a Catch All profile is to create a general policy with that profile and place it last in the list of policies.

Authentication policies can be accessed from Policy & Objects > Authentication Policy.

Settings

An empty field in a column indicates that the option has not been set.

Field

Definition

Rank Buttons

Moves the selected policy up or down in the list. Host connections are compared to Policies in order by rank.

Set Rank Button

Allows you to type a different rank number for a selected policy and immediately move the policy to that position. In an environment with a large number of policies this process is faster than using the up and down Rank buttons.

Table columns

Rank

Policy's rank in the list of policies. Rank controls the order in which host connections are compared to Policies.

Name

User defined name for the policy.

Authentication
Configuration

Contains the configuration for the authentication policy that will be assigned if this authentication policy matches the connecting host.
See Authentication configurations

User/Host Profile

Contains the required criteria for a connecting host, such as connection location, host or user group membership, host or user attributes or time of day. Host connections that match the criteria within the user/host profile are assigned the associated authentication configuration. See User/host profiles.

Note

User specified note field.

Last Modified By

User name of the last user to modify the policy.

Last Modified Date

Date and time of the last modification to this policy.

Right click options

Delete

Deletes the selected authentication policy.

Modify

Opens the modify authentication policy window for the selected policy.

Show Audit Log

Opens the admin auditing log showing all changes made to the selected item.

For information about the admin auditing log, see Audit Logs.

Note

You must have permission to view the admin auditing log. See Add an administrator profile.