Authentication servers
RADIUS Servers
FortiGate User Authentication Version 1 Guide
01-28007-0233-20050825
9
Authentication servers
FortiGate units support the following external authentication servers:
• RADIUS
• LDAP
• Microsoft Active Directory
If you are going to use authentication servers, you must configure the servers
before you configure FortiGate users or user groups that require them. An
authentication server can provide password checking for selected FortiGate users
or it can be added as a member of a FortiGate user group.
RADIUS Servers
Remote Authentication and Dial-in User Service (RADIUS) servers provide
authentication, authorization and accounting functions. FortiGate units use the
authentication function of the RADIUS server.
Understanding your RADIUS server
Your RADIUS server listens on either port 1812 or port 1645 for authentication
requests. You must configure it to accept the FortiGate unit as a client.
The RADIUS server user database can be any combination of:
• user names and passwords defined in a configuration file
• an SQL database
• the user account names and passwords configured on the computer where the
RADIUS server is installed
The RADIUS server uses a “shared secret” key to encrypt information passed
between it and clients such as the FortiGate unit.
See the documentation provided with your RADIUS server for configuration
details.
Configuring the FortiGate unit to use a RADIUS server
On the FortiGate unit, the default port for RADIUS traffic is 1812. If your RADIUS
server is using port 1645, you can either
• Reconfigure the RADIUS server to use port 1812. See your RADIUS server
documentation for more information.
or
• Change the FortiGate unit default RADIUS port to 1645 using the the CLI:
config system global
set radius_port 1645
end
