Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • Administration Guide

    Home FortiProxy 7.2.8 Administration Guide
    7.2.8
    7.6.0
    7.4.6
    7.4.5
    7.4.4
    7.4.3
    7.4.2
    7.4.1
    7.4.0
    7.2.12
    7.2.11
    7.2.10
    7.2.9
    7.2.8
    7.2.7
    7.2.0
    7.0.19
    7.0.17
    7.0.0
    2.0.0
    1.2.0
    1.1.0
    1.0.0

    Create or edit an administrator

    Create or edit an administrator

    Select Create New > Administrator to open the New Administrator page. It provides settings for configuring an administrator account. When you are configuring an administrator account, you can enable authentication for an admin from an LDAP, RADIUS, or local server.

    Select an administrator and then click Edit to open the Edit Administrator page.

    Configure the following settings in the New Administrator page or Edit Administrator page and then click OK:

    User Name

    Enter the login name for the administrator account.

    The name of the administrator should not contain the characters <, >, (, ), #, ", or '. Using these characters in the administrator account name can result in a cross-site scripting (XSS) vulnerability.

    Type

    Select the type of administrator account.

    • Local User—Select to create a local administrator account.

    • Match a user on a remote server group—Select to authenticate the administrator using a RADIUS, LDAP, or TACACS+ server. Server authentication for administrators must be configured first.

    • Match all users on a remote server group—Select to authenticate all users using a specific RADIUS, LDAP, or TACACS+ server. Server authentication for administrators must be configured first.

    • Use public key infrastructure (PKI) group—Select to enable certificate-based authentication for the administrator. Only one administrator can be logged in with PKI authentication enabled.

    Password

    Enter a password for the administrator account. For improved security, the password should be at least 6 characters long. Select the eye icon to view the password.

    This option is only available if Type is Local User.

    Confirm Password

    Type the password for the administrator account a second time to confirm that you have typed it correctly. Select the eye icon to view the password.

    This option is not available if Type is Use public key infrastructure (PKI) group.

    Backup Password

    Enter a backup password for the administrator account. For improved security, the password should be at least 6 characters long. Select the eye icon to view the password.

    This option is only available if Type is Match a user on a remote server group or Match all users in a remote server group.

    Comments

    Optionally, enter comments about the administrator account.

    Administrator Profile

    Select an administrator profile to use for the new administrator.

    To create an administrator profile, see Create or edit an administrator profile.

    Email Address

    If email is used for two-factor authentication, provide the email address at which the user will receive token password codes.

    Remote User Group

    Select the administrator user group that includes the remote server/PKI (peer) users as members of the Remote User Group. The administrator user group cannot be deleted after the group is selected for authentication.

    This option is only available if Type is Match a user on a remote server group or Match all users in a remote server group.

    PKI Group

    Select to allow all accounts on the RADIUS, LDAP, or TACACS+ server to be administrators.

    This option is only available if Type is Use public key infrastructure (PKI) group.

    SMS

    If SMS is used for two-factor authentication, enable SMS and provide the country dial code and SMS cell phone number at which the user will receive token password codes.

    Restrict login to trusted hosts

    Enable to restrict this administrator login to specific trusted hosts and then enter the IPv4 or IPv6 addresses and netmasks of the trusted hosts. You can specify up to 10 trusted hosts and 10 IPv6 trusted hosts.

    Restrict admin to guest account provisioning only

    Enable to create a guest management administrator and then select the name of the guest group.

    Regular (password) authentication for administrators

    You can use a password stored on the local unit to authenticate an administrator. When you select Local User for Type, you will see Local as the entry in the Type column when you view the list of administrators.

    Using trusted hosts

    Setting trusted hosts for all of your administrators increases the security of your network by further restricting administrative access. In addition to knowing the password, an administrator can connect only through the subnet or subnets that you specify. You can even restrict an administrator to a single IP address if you define only one trusted host IP address with a netmask of 255.255.255.255.

    When you set trusted hosts for all administrators, the unit does not respond to administrative access attempts from any other hosts. This provides the highest security. If you leave even one administrator unrestricted, the unit accepts administrative access attempts on any interface that has administrative access enabled, potentially exposing the unit to attempts to gain unauthorized access.

    The trusted hosts you define apply to the GUI, Ping, SNMP, and the CLI when accessed through Telnet or SSH. CLI access through the console port is not affected.

    The trusted host addresses all default to 0.0.0.0/0.0.0.0. If you set one of the zero addresses to a nonzero address, the other zero addresses will be ignored. The only way to use a wildcard entry is to leave the trusted hosts at 0.0.0.0/0.0.0.0. However, this configuration is less secure.

    Previous
    Next

    Create or edit an administrator

    Create or edit an administrator

    Select Create New > Administrator to open the New Administrator page. It provides settings for configuring an administrator account. When you are configuring an administrator account, you can enable authentication for an admin from an LDAP, RADIUS, or local server.

    Select an administrator and then click Edit to open the Edit Administrator page.

    Configure the following settings in the New Administrator page or Edit Administrator page and then click OK:

    User Name

    Enter the login name for the administrator account.

    The name of the administrator should not contain the characters <, >, (, ), #, ", or '. Using these characters in the administrator account name can result in a cross-site scripting (XSS) vulnerability.

    Type

    Select the type of administrator account.

    • Local User—Select to create a local administrator account.

    • Match a user on a remote server group—Select to authenticate the administrator using a RADIUS, LDAP, or TACACS+ server. Server authentication for administrators must be configured first.

    • Match all users on a remote server group—Select to authenticate all users using a specific RADIUS, LDAP, or TACACS+ server. Server authentication for administrators must be configured first.

    • Use public key infrastructure (PKI) group—Select to enable certificate-based authentication for the administrator. Only one administrator can be logged in with PKI authentication enabled.

    Password

    Enter a password for the administrator account. For improved security, the password should be at least 6 characters long. Select the eye icon to view the password.

    This option is only available if Type is Local User.

    Confirm Password

    Type the password for the administrator account a second time to confirm that you have typed it correctly. Select the eye icon to view the password.

    This option is not available if Type is Use public key infrastructure (PKI) group.

    Backup Password

    Enter a backup password for the administrator account. For improved security, the password should be at least 6 characters long. Select the eye icon to view the password.

    This option is only available if Type is Match a user on a remote server group or Match all users in a remote server group.

    Comments

    Optionally, enter comments about the administrator account.

    Administrator Profile

    Select an administrator profile to use for the new administrator.

    To create an administrator profile, see Create or edit an administrator profile.

    Email Address

    If email is used for two-factor authentication, provide the email address at which the user will receive token password codes.

    Remote User Group

    Select the administrator user group that includes the remote server/PKI (peer) users as members of the Remote User Group. The administrator user group cannot be deleted after the group is selected for authentication.

    This option is only available if Type is Match a user on a remote server group or Match all users in a remote server group.

    PKI Group

    Select to allow all accounts on the RADIUS, LDAP, or TACACS+ server to be administrators.

    This option is only available if Type is Use public key infrastructure (PKI) group.

    SMS

    If SMS is used for two-factor authentication, enable SMS and provide the country dial code and SMS cell phone number at which the user will receive token password codes.

    Restrict login to trusted hosts

    Enable to restrict this administrator login to specific trusted hosts and then enter the IPv4 or IPv6 addresses and netmasks of the trusted hosts. You can specify up to 10 trusted hosts and 10 IPv6 trusted hosts.

    Restrict admin to guest account provisioning only

    Enable to create a guest management administrator and then select the name of the guest group.

    Regular (password) authentication for administrators

    You can use a password stored on the local unit to authenticate an administrator. When you select Local User for Type, you will see Local as the entry in the Type column when you view the list of administrators.

    Using trusted hosts

    Setting trusted hosts for all of your administrators increases the security of your network by further restricting administrative access. In addition to knowing the password, an administrator can connect only through the subnet or subnets that you specify. You can even restrict an administrator to a single IP address if you define only one trusted host IP address with a netmask of 255.255.255.255.

    When you set trusted hosts for all administrators, the unit does not respond to administrative access attempts from any other hosts. This provides the highest security. If you leave even one administrator unrestricted, the unit accepts administrative access attempts on any interface that has administrative access enabled, potentially exposing the unit to attempts to gain unauthorized access.

    The trusted hosts you define apply to the GUI, Ping, SNMP, and the CLI when accessed through Telnet or SSH. CLI access through the console port is not affected.

    The trusted host addresses all default to 0.0.0.0/0.0.0.0. If you set one of the zero addresses to a nonzero address, the other zero addresses will be ignored. The only way to use a wildcard entry is to leave the trusted hosts at 0.0.0.0/0.0.0.0. However, this configuration is less secure.

    Previous
    Next