4.1 Local & Remote Authentication (LDAP, RADIUS, 2FA)

Local & Remote Authentication (LDAP, RADIUS, 2FA)

User authentication is a foundational security control in FortiOS 7.6, enabling administrators to enforce identity-aware firewall policies, control administrative access, and secure remote connectivity through SSL-VPN and IPsec tunnels. FortiGate supports two primary authentication paradigms: Local Authentication, where user identity records reside directly on the FortiGate unit, and Remote Authentication, where identity verification is offloaded to centralized Authentication, Authorization, and Accounting (AAA) servers such as LDAP, RADIUS, or TACACS+.

---

Local Authentication & User Groups

Local user authentication is suitable for small-scale deployments, administrative accounts, emergency backdoors, or guest network access. When a local user authenticates, FortiGate compares the submitted credentials against cryptographic hashes stored in its local configuration database.

Configuring Local Users

Local user accounts are created within config user local. Administrators can define password policies, set expiration dates, enable multi-factor authentication, and specify user contact details for token provisioning.

config user local
    edit "jdoe"
        set status enable
        set type password
        set passwd "P@ssword2026!Secure"
        set two-factor fortitoken
        set fortitoken "FTK200123456789"
        set email-to "jdoe@corp.local"
    next
end

User Groups

Firewall policies in FortiOS do not reference individual user objects directly; instead, policies enforce access controls based on User Groups. FortiGate supports several group types:

• Firewall Groups: Used for policy matching, combining local users, remote server queries, and PKI users.
• FSSO Groups: Used for passive Single Sign-On mapping from Active Directory.
• Guest Groups: Designed for transient captive portal access with automatic account expiration.

config user group
    edit "Engineering_Group"
        set group-type firewall
        set member "jdoe" "LDAP-AD-Server"
    next
end

---

Captive Portal & Authentication Timeouts

When unauthenticated users attempt to access HTTP/HTTPS resources through a firewall policy that requires user group matching, FortiGate intercepts the traffic and presents a Captive Portal web interface.

FortiGate maintains authenticated user sessions in memory (authd daemon) governed by three distinct timers:

1. Idle Timeout: Time of inactivity before FortiGate logs out the user (default: 15 minutes).
2. Hard Timeout: Maximum duration an authenticated session can remain active regardless of activity (default: disabled / 0 minutes).
3. Session Timeout: Maximum lifetime of an active stateful IP session.

Administrators can customize captive portal behavior per interface or globally under config system global and config user setting.

---

Remote Authentication Servers

In enterprise networks, managing user accounts locally on individual firewalls becomes unmanageable. FortiGate integrates with remote AAA servers to validate credentials centrally.

1. Lightweight Directory Access Protocol (LDAP)

LDAP is the primary protocol for integrating FortiGate with Microsoft Active Directory or OpenLDAP. FortiGate queries the directory hierarchy to authenticate passwords and verify group memberships using the memberOf attribute.

LDAP Bind Modes

• Anonymous Bind: FortiGate queries the directory without authenticating first. Restricted in modern Active Directory environments.
• Simple Bind: Transmits the user's Distinguished Name (DN) and password directly to the LDAP server. Requires encryption to prevent credential exposure.
• Regular (Bind DN) Mode: FortiGate uses a dedicated service account to search the directory tree for the user's object, retrieves their full DN, and then verifies the user's password.

Secure LDAP (LDAPS)

To prevent credentials from traveling in cleartext over port 389, administrators must enable secure ldaps over TCP port 636 or starttls over port 389, referencing a trusted CA certificate.

config user ldap
    edit "LDAP-AD-Server"
        set server "192.168.10.15"
        set server-identity "dc01.corp.local"
        set cnid "sAMAccountName"
        set dn "OU=Employees,DC=corp,DC=local"
        set type regular
        set username "CN=FortiService,OU=ServiceAccounts,DC=corp,DC=local"
        set password "ServiceAccountP@ss2026"
        set secure ldaps
        set port 636
        set ca-cert "CA_Cert_Internal"
    next
end

2. RADIUS Authentication

Remote Authentication Dial-In User Service (RADIUS) is an industry-standard AAA protocol operating over UDP port 1812 (Authentication) and UDP port 1813 (Accounting). RADIUS is widely used for SSL-VPN, 802.1X wireless access, and network access control (NAC).

RADIUS Group Matching via VSAs

Because standard RADIUS responses only confirm authentication success or failure, FortiGate relies on Vendor-Specific Attributes (VSAs) to pass group membership information back from the RADIUS server (e.g., Microsoft NPS or Cisco ISE). Fortinet VSA Subtype 1 (Fortinet-Group-Name) contains the group string that FortiGate matches against config user group entries.

config user radius
    edit "RADIUS-NPS"
        set server "192.168.10.20"
        set secret "SharedRadiusSecret2026!"
        set auth-type ms-chapv2
        set radius-port 1812
        set secondary-server "192.168.10.21"
        set secondary-secret "SharedRadiusSecret2026!"
        set timeout 5
        set retry 3
    next
end

3. TACACS+ Authentication

Terminal Access Controller Access-Control System Plus (TACACS+) operates over TCP port 49. Unlike RADIUS—which only encrypts the password payload—TACACS+ encrypts the entire packet payload. TACACS+ decouples authentication, authorization, and accounting, making it the industry preference for controlling administrative CLI/GUI access and auditing command execution on FortiGate devices.

---

Two-Factor Authentication (2FA) with FortiToken

To mitigate credential theft and phishing attacks, FortiOS 7.6 supports two-factor authentication using Time-based One-Time Passwords (TOTP) delivered via FortiToken hardware or FortiToken Mobile.

FortiToken Variants

• FortiToken Mobile (FTM): Software token application running on iOS or Android devices. Supports push notifications and OTP generation.
• FortiToken Hardware (FTK-200 / FTK-300): Physical key fob or display card generating 6-digit TOTP codes synchronized with FortiGate internal clocks.
• FortiToken Cloud (FTC): Centralized cloud-based 2FA service managed via FortiCloud, enabling push authentication across multi-FortiGate enterprise deployments.

FortiToken Mobile Provisioning Workflow

1. The administrator registers an available FortiToken Mobile license on FortiGate.
2. The token serial number is assigned to a user account (set two-factor fortitoken).
3. FortiGate generates an activation code and dispatches an activation email or SMS to the user containing a QR code link.
4. The user opens the FortiToken Mobile app, scans the QR code within the activation timeframe (default: 72 hours), and binds the token seed to their mobile device.

Enterprise Authentication Matrix

The following table compares the four primary user authentication mechanisms available in FortiOS 7.6: