Technical Tip: FortiGate with multiple wildcard admins authentications and VDOMs

Definition:

• Remote (Match a user on a remote server Group).
• Remote+Wildcard (Match all users in a remote server Group).

When FortiOS receives a system login request, it first looks for a system admin account whose name exactly matches the requested name. If it cannot find an exact match, FortiOS will look for a wildcard system admin account, either global or vdom specific, whichever comes first. In this case, the global wildcard account is always returned first, which is expected according to source codes.

It is recommended to have one wildcard admin per VDOM, otherwise, the authentication will only be done towards the group with the most alphabetical order preference. 'Global wildcard admin user' will be present in all VDOMs, thus if the name of the group makes it first in the list it will be the only one matched for all wildcard users. This is also true, when wildcard users refers to user groups that belong to different servers ( Radius, LDAP or TACACS) . It is recommended to have each Firewall administrator as a 'remote' only 'Match a user on remote server Group'. This also means it is necessary to create one global wildcard system admin account or one wildcard system admin account for each VDOM, not one for both.

Create a user that will then be mapped to a Remote Group.

Although it is possible to use 'Remote+Wildcard', it is necessary to keep in mind the limitation of having only one group.

Consider the following option:

Have admin (Remote+Wildcard) settings for admin profiles or guest admins attached to the correct VDOM (access should be acquired from the VDOM Management IP), then have admin (Remote) settings for the global admin.

Related documents:

• Configuring wildcard admin accounts
• Technical Tip: Configuring LDAP users as the Guest account sponsor
• Technical Tip: Remote admin login with Radius selecting admin access account profile
• Technical Tip: FortiGate - Admin login with remote RADIUS and VDOM access profile