DOCUMENT LIBRARY
DOCUMENT LIBRARY
Products
Best Practices
Hardware Guides
Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
Hybrid Mesh Firewall
FortiGate/ FortiOS
FortiGate-5000
/
6000
/
7000
NOC Management
FortiManager
/
FortiManager Cloud
Managed Fortigate Service
LAN
FortiSwitch
FortiAP / FortiWiFi
FortiEdge Cloud
FortiNAC-F
WAN
Secure SD-WAN
FortiExtender
More >>
Unified SASE
Single Vendor SASE
FortiSASE
Secure SD-WAN
Zero Trust Network Access (ZTNA)
FortiProxy
FortiMonitor
Cloud Network Security
FortiGate Public Cloud
FortiGate Private Cloud
FortiGate CNF
FortiFlex
Lacework FortiCNAPP
Secure Endpoint Connectivity
FortiClient
/
FortiClient Cloud
Web Application / API Protection
FortiWeb
FortiADC
FortiDAST
More >>
Security Operations
Security Operations Automation
FortiAnalyzer
/
FortiAnalyzer Cloud
FortiSIEM
/
FortiSIEM Cloud
FortiSOAR
SOC-as-a-Service (SOCaaS)
Identity
FortiAuthenticator
FortiTrust Identity
FortiPAM
Early Detection & Prevention
FortiSandbox
/
FortiSandbox Cloud
FortiNDR
FortiDeceptor
FortiRecon
More >>
Secure Networking
Hybrid Mesh Firewall
FortiGate/ FortiOS
FortiGate-5000
/
6000
/
7000
NOC Management
FortiManager
/
FortiManager Cloud
Managed Fortigate Service
FortiAIOps
LAN
FortiSwitch
FortiAP / FortiWiFi
FortiAP-U Series
FortiEdge Cloud
FortiNAC-F
WAN
Secure SD-WAN
FortiExtender
Communication & Surveillance
FortiVoice
/
FortiVoice Cloud
FortiFone
FortiCamera
FortiRecorder
FortiCentral
Unified SASE
Single Vendor SASE
FortiSASE
Secure SD-WAN
Zero Trust Network Access (ZTNA)
FortiProxy
FortiMonitor
Secure Endpoint Connectivity
FortiClient
/
FortiClient Cloud
Cloud Network Security
FortiGate Public Cloud
FortiGate Private Cloud
FortiGate CNF
FortiFlex
Cloud-Native Security
Lacework FortiCNAPP
FortiDevSec
Web Application / API Protection
FortiWeb
FortiADC
FortiDAST
Security Operations
Security Operations Automation
FortiAnalyzer
/
FortiAnalyzer Cloud
FortiSIEM
/
FortiSIEM Cloud
FortiSOAR
Endpoint
FortiClient
/
FortiClient Cloud
FortiEDR/XDR
Data Protection
FortiDLP
FortiDLP Agent
FortiDLP Policies
Identity
FortiAuthenticator
FortiTrust Identity
FortiToken
/
FortiToken Cloud
FortiPAM
Email
FortiMail
FortiPhish
Early Detection & Prevention
FortiSandbox
/
FortiSandbox Cloud
FortiNDR
FortiDeceptor
FortiRecon
Expert Services
SOC-as-a-Service (SOCaaS)
Edge Firewall
FortiGate/FortiOS
FortiGate-5000
/
6000
/
7000
FortiGate Public Cloud
FortiGate Private Cloud
Orchestration & management
FortiManager
/
FortiManager Cloud
FortiAnalyzer
/
FortiAnalyzer Cloud
Overlay-as-a-Service
SD Branch
FortiSwitch
FortiAP / FortiWiFi
FortiExtender
/
FortiExtender Cloud
Application Delivery
FortiADC
/
FortiGSLB
Single Vendor SASE
FortiSASE
Secure Endpoint Connectivity
FortiClient
/
FortiClient Cloud
Secure Private Access
Secure SD-WAN
Zero Trust Network Access (ZTNA)
Thin Edge
FortiGate/ FortiOS
FortiAP / FortiWiFi
FortiExtender
/
FortiExtender Cloud
Identity
FortiAuthenticator
FortiTrust Identity
FortiToken Cloud
FortiToken
Application Gateway
FortiGate/ FortiOS
FortiProxy
FortiADC
/
FortiGSLB
Enterprise Asset Management
FortiClient EMS
Endpoint Agent
FortiClient
/
FortiClient Cloud
Agentless Security Posture
FortiNAC-F
FortiSIEM
/
FortiSIEM Cloud
Identity
FortiAuthenticator
FortiTrust Identity
FortiToken Cloud
FortiToken
Wireless
FortiAP / FortiWiFi
FortiAP-U Series
FortiGate Cloud
Switching
FortiSwitch
FortiEdge Cloud
FortiNAC-F
Identity
FortiAuthenticator
FortiTrust Identity
FortiToken Cloud
FortiToken
Privilege Acccess Management
FortiPAM
Next Generation Firewall
FortiGate / FortiOS
FortiGate-5000
/
6000
/
7000
FortiGate Public Cloud
FortiGate Private Cloud
Orchestration & management
FortiManager
/
FortiManager Cloud
FortiAnalyzer
/
FortiAnalyzer Cloud
Expert Services
SOC-as-a-Service (SOCaaS)
Managed Fortigate Service
All
FortiADC Public Cloud
FortiAnalyzer Public Cloud
FortiAuthenticator Public Cloud
FortiDeceptor Public Cloud
FortiGate Public Cloud
FortiIsolator Public Cloud
FortiManager Public Cloud
FortiNDR Public Cloud
FortiPAM Public Cloud
FortiPortal Public Cloud
FortiProxy Public Cloud
FortiSandbox Public Cloud
FortiTester Public Cloud
FortiVoice Public Cloud
FortiWeb Manager Public Cloud
FortiWeb Public Cloud
All
FortiADC Private Cloud
FortiAnalyzer BigData Private Cloud
FortiAnalyzer Private Cloud
FortiAuthenticator Private Cloud
FortiDeceptor Private Cloud
FortiGate Private Cloud
FortiManager Private Cloud
FortiNDR Private Cloud
FortiPAM Private Cloud
FortiProxy Private Cloud
FortiSandbox Private Cloud
FortiTester Private Cloud
FortiVoice Private Cloud
FortiWeb Manager Private Cloud
FortiWeb Private Cloud
Account Management
FortiCloud Services
SAAS Management
FortiGate Cloud
FortiEdge Cloud
FortiEdge Cloud
FortiExtender Cloud
FortiPresence Cloud
FortiToken Cloud
FortiTrust Identity
FortiZTP
FortiCamera Cloud
SAAS Application Security
FortiWeb Cloud
FortiGSLB
FortiCASB
FortiCNP
FortiInsight
FortiPhish
FortiGate CNF
Managed Services
SOC-as-a-Service (SOCaaS)
Managed Fortigate Service
Platform as a service (PAAS)
FortiSASE
FortiAnalyzer Cloud
FortiManager Cloud
FortiClient Cloud
FortiSandbox Cloud
FortiMail Cloud
FortiSOAR Cloud
Other SAAS Services
Overlay-as-a-Service
FortiRecon
FortiConverter
ForiIPAM
FortiFlex
FortiCare Elite
4D Resources
Solution Hubs
Define, design, deploy, demo
4D Pillars
Secure SD-WAN
Zero Trust Network Access
Wireless
Switching
Secure Access Service Edge
Identity and Access Management
Next Generation Firewall
Curated Links by Solution
Cloud
FortiCloud
Public & Private Cloud
Popular Solutions
Secure SD-WAN
Zero Trust Network Access
Secure Access
Security Fabric
Tele-Working
Multi-Factor Authentication
FortiASIC
Operational Technology
MSSP
Next Generation Firewall
FortiAnalyzer
FortiAnalyzer Big-Data
FortiADC
FortiAP / FortiWiFi
FortiAP U-Series
FortiAuthenticator
FortiCache
FortiCarrier
FortiController
FortiDDoS
FortiDDoS-F
FortiDeceptor
FortiExtender
FortiGate-5000
FortiGate-6000
FortiGate-7000
FortiHypervisor
FortiIsolator
FortiMail
FortiManager
FortiNAC
FortiNDR
FortiProxy
FortiRecorder
FortiGate
FortiRPS
FortiSandbox
FortiSIEM
FortiSwitch
FortiTester
FortiToken
FortiVoice
FortiWAN
FortiWeb
FortiWLC
FortiWLM
AscenLink
AV Engine
AWS Firewall Rules
Container FortiOS
FortiADC
FortiADC E Series
FortiADC Manager
FortiADC Private Cloud
FortiADC Public Cloud
FortiAIOps
FortiAnalyzer
FortiAnalyzer BigData
FortiAnalyzer BigData Private Cloud
FortiAnalyzer Cloud
FortiAnalyzer Private Cloud
FortiAnalyzer Public Cloud
FortiAP / FortiWiFi
FortiAP-U Series
FortiAuthenticator
FortiAuthenticator Private Cloud
FortiAuthenticator Public Cloud
FortiAuthProxy
FortiBalancer
FortiBranchSASE
FortiBridge
FortiCache
FortiCamera
FortiCamera Cloud
FortiCare Elite
FortiCarrier
FortiCASB
FortiCentral
FortiClient
FortiClient Cloud
FortiCloud Services
FortiCNP
FortiConnect
FortiController
FortiConverter Service
FortiConverter Tool
FortiCore
FortiCSPM
FortiCWP
FortiDAST
FortiDB
FortiDDoS
FortiDDoS-F
FortiDeceptor
FortiDeceptor DaaS
FortiDeceptor Private Cloud
FortiDeceptor Public Cloud
FortiDevSec
FortiDLP
FortiDLP Agent
FortiDLP Policies
FortiDNS
FortiEdge Cloud
FortiEDR/XDR
FortiEndpoint
FortiExplorer
FortiExplorer Go
FortiExtender
FortiFlex
FortiFone
FortiGate / FortiOS
FortiGate Cloud
FortiGate CNF
FortiGate Private Cloud
FortiGate Public Cloud
FortiGate-5000
FortiGate-6000
FortiGate-7000
FortiGate-as-a-Service
FortiGSLB
FortiGuard Advanced Bot Protection
FortiGuest
FortiHypervisor
FortiInsight
FortiInsight Cloud
FortiIPAM
FortiIsolator
FortiIsolator Public Cloud
FortiLAN Cloud
FortiMail
FortiMail Cloud
FortiManager
FortiManager Cloud
FortiManager Private Cloud
FortiManager Public Cloud
FortiMonitor
FortiNAC
FortiNAC-F
FortiNDR
FortiNDR (on-premise) Private Cloud
FortiNDR (on-premise) Public Cloud
FortiNDR Cloud
FortiNDR Cloud Sensors
FortiPAM
FortiPAM Private Cloud
FortiPAM Public Cloud
FortiPhish
FortiPlanner
FortiPolicy
FortiPortal
FortiPortal Public Cloud
FortiPresence
FortiPresence VM
FortiProxy
FortiProxy Private Cloud
FortiProxy Public Cloud
FortiRecon
FortiRecorder
FortiRPS
FortiSandbox
FortiSandbox Cloud
FortiSandbox Private Cloud
FortiSandbox Public Cloud
FortiSASE
FortiScanner
FortiSIEM
FortiSIEM Cloud
FortiSOAR
FortiSOAR Cloud
FortiSRA
FortiSwitch
FortiSwitch Manager
FortiTap
FortiTester
FortiTester Private Cloud
FortiTester Public Cloud
FortiToken
FortiToken Cloud
FortiTrust Identity
FortiVoice
FortiVoice Cloud
FortiVoice Private Cloud
FortiVoice Public Cloud
FortiWAN
FortiWAN Controller
FortiWeb
FortiWeb Cloud
FortiWeb Manager Private Cloud
FortiWeb Manager Public Cloud
FortiWeb Private Cloud
FortiWeb Public Cloud
FortiWLM
FortiZTP
IPS Engine
Lacework FortiCNAPP
Managed FortiGate Service
Overlay-as-a-Service
Security Awareness and Training
SOCaaS
Wireless Controller
Search documents and hardware ...
Examples
Introduction
FortiToken and FortiToken Mobile
2FA with FortiToken Mobile
Adding a FortiToken to FortiPAM
Configuring a local user with FortiToken as the authentication type
Enabling FortiToken Mobile push notification
Results
Setting up FortiToken Mobile
RADIUS authentication
2FA on FortiPAM for RADIUS users using FortiAuthenticator
Configuring a RADIUS server on FortiPAM
Creating remote user group on FortiPAM
Enabling 2FA on FortiAuthenticator
Creating a RADIUS user on FortiPAM
Results
SAML authentication
2FA on FortiPAM for SAML users using FortiAuthenticator
Importing FortiAuthenticator certificate to FortiPAM
Configuring FortiAuthenticator as a SAML IdP
Configuring FortiPAM as an SP
Creating a remote user group on FortiPAM
Creating a SAML user on FortiPAM
Results
ZTNA
ZTNA endpoint control on FortiPAM
Configuring EMS on FortiPAM
Registering the endpoint PC to EMS server
Configuring a ZTNA server on FortiPAM
Configuring proxy rule on FortiPAM
Adding a ZTNA tag to a secret for launching control
Secret configurations
Accessing a Linux server using PuTTY
Creating a secret with Unix template
Launching a secret for the Linux server
Accessing a Cisco router using PuTTY
Creating an associated secret
Creating a secret with Cisco User (SSH Secret) template
Launching a secret for the Cisco router
Accessing a FortiGate using PuTTY, Web SSH, or the Web launcher
Creating a secret with Unix template
Launching a secret for the FortiGate
Accessing a Windows server using the Remote Desktop- Windows launcher
Creating a secret with Windows Machine template
Launching a secret for the Windows server
Visiting a web application/platform using web launchers
Installing Fortinet Privileged Access Agent web extension on Chrome/Edge
Creating a secret for general web application/platform
Creating a secret for AWS root/IAM account
Visiting web application/platform using web launcher
Reviewing video recording for the web launching session
Reviewing secret log for the web launching session
Accessing a generic machine using Web VNC, VNC Viewer, or the TightVNC launcher
Creating a secret with Machine template
Launching a secret for the machine
Accessing a target server using locally installed WinSCP client
Installing WinSCP on a local machine
Creating a secret with Unix Account (SSH Password) template
Launching a secret for the target server using the WinSCP launcher
Accessing an SFTP server using the Web SFTP secret launcher
Creating a secret with Unix Account (SSH Password) template
Launching a secret for the SFTP server using the Web SFTP launcher
Accessing an SMB server using Web SMB launcher
Creating a secret with Windows Domain Account (Samba) template
Verifying the password
Launching a secret for the SMB server using the Web SMB launcher
Checking out and checking in a secret
Creating a secret with check out enabled
Checking out a secret
Checking in a secret
Using a secret requiring approval
Creating an approval profile
Creating a secret with mandatory approval requirement
Sending a request to access a secret
Approving a secret request
Launching a secret that requires approval
Running a script on a target server using jobs
Creating a job approval profile
Creating a secret with mandatory approval requirement for launching a job
Creating an ssh script type job
Sending a request to access the job
Approving a job request
Results
Configuring a secret that supports TOTP
Configuring a secret template with TOTP
Creating a secret with TOTP enabled
Accessing a MySQL server using MySQL CLI launcher
Creating a secret using the database server template
Launching a secret for the MySQL server
Configuring integrity check for the PuTTY launcher
Creating an entry for the PuTTY launcher
Enabling integrity check in the launcher and secret template
Creating a secret with integrity check
Launching the secret
Block uploading a JavaScript file via the Web SFTP launcher
Configuring the DLP file pattern
Configuring a DLP sensor profile
Creating a secret with a DLP sensor profile
Results
Block transferring .exe files and log file downloads of size larger than 500KB
Configuring the DLP file pattern
Configuring a DLP sensor profile
Creating a secret with a DLP sensor profile
Results
Updating a service account credential
Updating a service account credential
Creating a secret with the Certificate Vault template
Creating a certificate secret
Setting up email alert for certificate expiry
Configuring a secret using the Target Only secret template
Example 1: Creating a secret using the Target Only template
Example 1: Launching the secret
Example 2: Creating a secret using the Target Only template
Example 2: Launching the secret
Audit
Sponsored administrator audits secret activities
Creating a sponsored group
Creating a sponsor admin
Creating a secret with view permission for the sponsored group
Creating sponsored group members
Auditing
Web proxy
Configuring the web proxy feature to prevent web credentials from leaking
Enabling the web proxy feature
Creating a secret target with web proxy
Creating a secret with web proxy
FortiPAM behind a FortiGate device
RDP log retrieval
RDP log retrieving on FortiPAM
Creating an event filter profile
Creating a secret policy
Creating a secret target
Creating secret with an RDP event filter profile
Launching the secret
Checking the RDP logs
Gateway
FortiPAM connects to a target through a FortiProxy acting as the gateway
Creating the FortiProxy gateway
Creating the secret target on FortiPAM
FortiProxy related configurations
Configuring FortiPAM/FortiGate as the reverse gateway
Configuring the reverse service on FortiPAM
Configuring reverse service on the gateway
Configuring traffic proxy on the gateway for forwarding secret launch (traffic plane)
Configuring a gateway entry on FortiPAM server for secret launch (traffic plane)
Configuring a target using reverse gateway on the FortiPAM server
Creating a secret for the target that uses the FortiPAM reverse gateway
Launching the FortiPAM secret
Creating a secret for the target that uses the FortiGate reverse gateway
Launching the FortiGate secret
Troubleshooting
Configuring FortiGate ZTFP forwarding access request from FortiPAM to the private target
Configuring ZTFP on FortiGate
Configuring a gateway on the FortiPAM server
Configuring a target using the forward gateway on FortiPAM server
Creating a secret for the target
Launching the secret from the FortiPAM server
Monitoring the secret
Troubleshooting
SSH filter profiles
Configuring an SSH filter profile on FortiPAM to restrict SSH access to secret servers
Configuring SSH filter profiles in the CLI
Configuring SSH filter profiles using the GUI
Automation
Using default automation stitch- Secret Credential View
Using the Secret Credential View automation stitch
Results
Customizing an automation stitch
Creating an automation trigger
Create an action
Creating a stitch
Results
Windows application filter
Creating a Windows application filter to prevent running executables
Setting up WinRM on the remote server
Creating a target with server information as Windows
Creating a Windows application filter profile
Creating a privileged account secret
Creating a non-privileged account
Launching the secret
Creating a non-Windows application filter to prevent running executables
Creating a target with server information as non-Windows
Creating a non-privilged secret
Web launcher
Using web launcher to auto fill credentials on a website
Creating a secret template
Creating a secret to connect to FortiAuthenticator
Launching the secret
Log and video disks
Back up and restore your log and video files
Enabling maintenance mode on FortiPAM
Backing up videos to the FTP server
Backing up logs to the FTP server
Shutting down the FortiPAM-VM and change log and video disks
Restoring videos from the FTP server
Restoring logs from the FTP server
Certificate management
Configuring certificate using the ACME protocol to access a FortiPAM instance
Creating a certificate
Configuring the FortiPAM SSL certificate
Change Log
Home
FortiPAM 1.4.0
Examples
1.4.0
1.4.0
1.3.0
1.2.0
1.1.0
1.0.0
Automation
Automation
This section describes examples related to
FortiPAM
automations.
Previous
Next
Automation
Automation
This section describes examples related to
FortiPAM
automations.
Previous
Next
Home
Product Pillars
Network Security
Network Security
FortiGate / FortiOS
FortiGate 5000
FortiGate 6000
FortiGate 7000
FortiProxy
NOC & SOC Management
FortiManager
FortiManager Cloud
FortiAnalyzer
FortiAnalyzer Cloud
FortiMonitor
FortiGate Cloud
Enterprise Networking
Secure SD-WAN
FortiLAN Cloud
FortiSwitch
FortiAP / FortiWiFi
FortiAP-U Series
FortiNAC-F
FortiExtender
FortiExtender Cloud
FortiAIOps
Business Communications
FortiFone
FortiVoice
FortiVoice Cloud
FortiRecorder
FortiCamera
Zero Trust Access
ZTNA
Zero Trust Network Access
FortiClient EMS
SASE
FortiSASE
Identity
FortiAuthenticator
FortiTrust Identity
FortiToken Cloud
FortiToken
Cloud Security
Hybrid Cloud Security
FortiGate Public Cloud
FortiGate Private Cloud
FortiFlex
Cloud Native Protection
FortiCNP
FortiDevSec
Web Application / API Protection
FortiWeb
FortiWeb Cloud
FortiADC
FortiGSLB
FortiGuard ABP
SAAS Security
FortiMail
FortiMail Cloud
FortiCASB
Security Operations
SOC Platform
FortiAnalyzer
FortiAnalyzer Cloud
FortiSIEM
/
FortiSIEM Cloud
FortiSOAR
FortiPhish
Advanced Threat Protection
FortiSandbox
FortiSandbox Cloud
FortiNDR
FortiNDR Cloud
FortiDeceptor
FortiInsight
FortiInsight Cloud
FortiIsolator
Endpoint Security
FortiClient
FortiClient Cloud
FortiEDR
Best Practices
Solution Hubs
Cloud
FortiCloud
Public & Private Cloud
Popular Solutions
Secure SD-WAN
Zero Trust Network Access
Secure Access
Next Generation Firewall
Security Fabric
Tele-Working
Multi-Factor Authentication
FortiASIC
Operational Technology
MSSP
4-D Resources
Secure SD-WAN
Zero Trust Network Access
Wireless
Switching
Secure Access Service Edge
Identity and Access Management
Next Generation Firewall
Hardware Guides
FortiAnalyzer
FortiAnalyzer Big-Data
FortiADC
FortiAP / FortiWiFi
FortiAP U-Series
FortiAuthenticator
FortiCache
FortiCarrier
FortiController
FortiDDoS
FortiDDoS-F
FortiDeceptor
FortiExtender
FortiGate
FortiGate-5000
FortiGate-6000
FortiGate-7000
FortiHypervisor
FortiIsolator
FortiMail
FortiManager
FortiNAC
FortiNDR
FortiProxy
FortiRecorder
FortiRPS
FortiSandbox
FortiSIEM
FortiSwitch
FortiTester
FortiToken
FortiVoice
FortiWAN
FortiWeb
FortiWLC
FortiWLM
Product A-Z
AscenLink
AV Engine
AWS Firewall Rules
Container FortiOS
FortiADC
FortiADC E Series
FortiADC Manager
FortiADC Private Cloud
FortiADC Public Cloud
FortiAIOps
FortiAnalyzer
FortiAnalyzer BigData
FortiAnalyzer BigData Private Cloud
FortiAnalyzer Cloud
FortiAnalyzer Private Cloud
FortiAnalyzer Public Cloud
FortiAP / FortiWiFi
FortiAP-U Series
FortiAuthenticator
FortiAuthenticator Private Cloud
FortiAuthenticator Public Cloud
FortiAuthProxy
FortiBalancer
FortiBranchSASE
FortiBridge
FortiCache
FortiCamera
FortiCamera Cloud
FortiCare Elite
FortiCarrier
FortiCASB
FortiCentral
FortiClient
FortiClient Cloud
FortiCloud Services
FortiCNP
FortiConnect
FortiController
FortiConverter Service
FortiConverter Tool
FortiCore
FortiCSPM
FortiCWP
FortiDAST
FortiDB
FortiDDoS
FortiDDoS-F
FortiDeceptor
FortiDeceptor DaaS
FortiDeceptor Private Cloud
FortiDeceptor Public Cloud
FortiDevSec
FortiDLP
FortiDLP Agent
FortiDLP Policies
FortiDNS
FortiEdge Cloud
FortiEDR/XDR
FortiEndpoint
FortiExplorer
FortiExplorer Go
FortiExtender
FortiFlex
FortiFone
FortiGate / FortiOS
FortiGate Cloud
FortiGate CNF
FortiGate Private Cloud
FortiGate Public Cloud
FortiGate-5000
FortiGate-6000
FortiGate-7000
FortiGate-as-a-Service
FortiGSLB
FortiGuard Advanced Bot Protection
FortiGuest
FortiHypervisor
FortiInsight
FortiInsight Cloud
FortiIPAM
FortiIsolator
FortiIsolator Public Cloud
FortiLAN Cloud
FortiMail
FortiMail Cloud
FortiManager
FortiManager Cloud
FortiManager Private Cloud
FortiManager Public Cloud
FortiMonitor
FortiNAC
FortiNAC-F
FortiNDR
FortiNDR (on-premise) Private Cloud
FortiNDR (on-premise) Public Cloud
FortiNDR Cloud
FortiNDR Cloud Sensors
FortiPAM
FortiPAM Private Cloud
FortiPAM Public Cloud
FortiPhish
FortiPlanner
FortiPolicy
FortiPortal
FortiPortal Public Cloud
FortiPresence
FortiPresence VM
FortiProxy
FortiProxy Private Cloud
FortiProxy Public Cloud
FortiRecon
FortiRecorder
FortiRPS
FortiSandbox
FortiSandbox Cloud
FortiSandbox Private Cloud
FortiSandbox Public Cloud
FortiSASE
FortiScanner
FortiSIEM
FortiSIEM Cloud
FortiSOAR
FortiSOAR Cloud
FortiSRA
FortiSwitch
FortiSwitch Manager
FortiTap
FortiTester
FortiTester Private Cloud
FortiTester Public Cloud
FortiToken
FortiToken Cloud
FortiTrust Identity
FortiVoice
FortiVoice Cloud
FortiVoice Private Cloud
FortiVoice Public Cloud
FortiWAN
FortiWAN Controller
FortiWeb
FortiWeb Cloud
FortiWeb Manager Private Cloud
FortiWeb Manager Public Cloud
FortiWeb Private Cloud
FortiWeb Public Cloud
FortiWLM
FortiZTP
IPS Engine
Lacework FortiCNAPP
Managed FortiGate Service
Overlay-as-a-Service
Security Awareness and Training
SOCaaS
Wireless Controller
Ordering Guides
Download PDF
Table of Contents
Introduction
FortiToken and FortiToken Mobile
2FA with FortiToken Mobile
Adding a FortiToken to FortiPAM
Configuring a local user with FortiToken as the authentication type
Enabling FortiToken Mobile push notification
Results
Setting up FortiToken Mobile
RADIUS authentication
2FA on FortiPAM for RADIUS users using FortiAuthenticator
Configuring a RADIUS server on FortiPAM
Creating remote user group on FortiPAM
Enabling 2FA on FortiAuthenticator
Creating a RADIUS user on FortiPAM
Results
SAML authentication
2FA on FortiPAM for SAML users using FortiAuthenticator
Importing FortiAuthenticator certificate to FortiPAM
Configuring FortiAuthenticator as a SAML IdP
Configuring FortiPAM as an SP
Creating a remote user group on FortiPAM
Creating a SAML user on FortiPAM
Results
ZTNA
ZTNA endpoint control on FortiPAM
Configuring EMS on FortiPAM
Registering the endpoint PC to EMS server
Configuring a ZTNA server on FortiPAM
Configuring proxy rule on FortiPAM
Adding a ZTNA tag to a secret for launching control
Secret configurations
Accessing a Linux server using PuTTY
Creating a secret with Unix template
Launching a secret for the Linux server
Accessing a Cisco router using PuTTY
Creating an associated secret
Creating a secret with Cisco User (SSH Secret) template
Launching a secret for the Cisco router
Accessing a FortiGate using PuTTY, Web SSH, or the Web launcher
Creating a secret with Unix template
Launching a secret for the FortiGate
Accessing a Windows server using the Remote Desktop- Windows launcher
Creating a secret with Windows Machine template
Launching a secret for the Windows server
Visiting a web application/platform using web launchers
Installing Fortinet Privileged Access Agent web extension on Chrome/Edge
Creating a secret for general web application/platform
Creating a secret for AWS root/IAM account
Visiting web application/platform using web launcher
Reviewing video recording for the web launching session
Reviewing secret log for the web launching session
Accessing a generic machine using Web VNC, VNC Viewer, or the TightVNC launcher
Creating a secret with Machine template
Launching a secret for the machine
Accessing a target server using locally installed WinSCP client
Installing WinSCP on a local machine
Creating a secret with Unix Account (SSH Password) template
Launching a secret for the target server using the WinSCP launcher
Accessing an SFTP server using the Web SFTP secret launcher
Creating a secret with Unix Account (SSH Password) template
Launching a secret for the SFTP server using the Web SFTP launcher
Accessing an SMB server using Web SMB launcher
Creating a secret with Windows Domain Account (Samba) template
Verifying the password
Launching a secret for the SMB server using the Web SMB launcher
Checking out and checking in a secret
Creating a secret with check out enabled
Checking out a secret
Checking in a secret
Using a secret requiring approval
Creating an approval profile
Creating a secret with mandatory approval requirement
Sending a request to access a secret
Approving a secret request
Launching a secret that requires approval
Running a script on a target server using jobs
Creating a job approval profile
Creating a secret with mandatory approval requirement for launching a job
Creating an ssh script type job
Sending a request to access the job
Approving a job request
Results
Configuring a secret that supports TOTP
Configuring a secret template with TOTP
Creating a secret with TOTP enabled
Accessing a MySQL server using MySQL CLI launcher
Creating a secret using the database server template
Launching a secret for the MySQL server
Configuring integrity check for the PuTTY launcher
Creating an entry for the PuTTY launcher
Enabling integrity check in the launcher and secret template
Creating a secret with integrity check
Launching the secret
Block uploading a JavaScript file via the Web SFTP launcher
Configuring the DLP file pattern
Configuring a DLP sensor profile
Creating a secret with a DLP sensor profile
Results
Block transferring .exe files and log file downloads of size larger than 500KB
Configuring the DLP file pattern
Configuring a DLP sensor profile
Creating a secret with a DLP sensor profile
Results
Updating a service account credential
Updating a service account credential
Creating a secret with the Certificate Vault template
Creating a certificate secret
Setting up email alert for certificate expiry
Configuring a secret using the Target Only secret template
Example 1: Creating a secret using the Target Only template
Example 1: Launching the secret
Example 2: Creating a secret using the Target Only template
Example 2: Launching the secret
Audit
Sponsored administrator audits secret activities
Creating a sponsored group
Creating a sponsor admin
Creating a secret with view permission for the sponsored group
Creating sponsored group members
Auditing
Web proxy
Configuring the web proxy feature to prevent web credentials from leaking
Enabling the web proxy feature
Creating a secret target with web proxy
Creating a secret with web proxy
FortiPAM behind a FortiGate device
RDP log retrieval
RDP log retrieving on FortiPAM
Creating an event filter profile
Creating a secret policy
Creating a secret target
Creating secret with an RDP event filter profile
Launching the secret
Checking the RDP logs
Gateway
FortiPAM connects to a target through a FortiProxy acting as the gateway
Creating the FortiProxy gateway
Creating the secret target on FortiPAM
FortiProxy related configurations
Configuring FortiPAM/FortiGate as the reverse gateway
Configuring the reverse service on FortiPAM
Configuring reverse service on the gateway
Configuring traffic proxy on the gateway for forwarding secret launch (traffic plane)
Configuring a gateway entry on FortiPAM server for secret launch (traffic plane)
Configuring a target using reverse gateway on the FortiPAM server
Creating a secret for the target that uses the FortiPAM reverse gateway
Launching the FortiPAM secret
Creating a secret for the target that uses the FortiGate reverse gateway
Launching the FortiGate secret
Troubleshooting
Configuring FortiGate ZTFP forwarding access request from FortiPAM to the private target
Configuring ZTFP on FortiGate
Configuring a gateway on the FortiPAM server
Configuring a target using the forward gateway on FortiPAM server
Creating a secret for the target
Launching the secret from the FortiPAM server
Monitoring the secret
Troubleshooting
SSH filter profiles
Configuring an SSH filter profile on FortiPAM to restrict SSH access to secret servers
Configuring SSH filter profiles in the CLI
Configuring SSH filter profiles using the GUI
Automation
Using default automation stitch- Secret Credential View
Using the Secret Credential View automation stitch
Results
Customizing an automation stitch
Creating an automation trigger
Create an action
Creating a stitch
Results
Windows application filter
Creating a Windows application filter to prevent running executables
Setting up WinRM on the remote server
Creating a target with server information as Windows
Creating a Windows application filter profile
Creating a privileged account secret
Creating a non-privileged account
Launching the secret
Creating a non-Windows application filter to prevent running executables
Creating a target with server information as non-Windows
Creating a non-privilged secret
Web launcher
Using web launcher to auto fill credentials on a website
Creating a secret template
Creating a secret to connect to FortiAuthenticator
Launching the secret
Log and video disks
Back up and restore your log and video files
Enabling maintenance mode on FortiPAM
Backing up videos to the FTP server
Backing up logs to the FTP server
Shutting down the FortiPAM-VM and change log and video disks
Restoring videos from the FTP server
Restoring logs from the FTP server
Certificate management
Configuring certificate using the ACME protocol to access a FortiPAM instance
Creating a certificate
Configuring the FortiPAM SSL certificate
Change Log
