Technical Tip: How to configure RADIUS over TLS for admin access in the FortiNDR with the FortiAuthenticator as Radius Server

Description

This article describes how to configure RADIUS over TLS for admin access in the FortiNDR with the FortiAuthenticator as Radius Server.

Scope

FortiNDR.

Solution

Configuration in FortiNDR:

1. Generate a CSR (Certificate Signing Request) at System -> Certificate -> Generate in the FortiNDR.
   
   

   

2. Sign the FortiNDR 'CSR', in this case, follow the guide below to sign the CSR in FortiAuthenticator:
   Technical Tip: How to sign a CSR on FortiAuthenticator

3. Export the signed certificate and 'CA' certificate from the FortiAuthenticator and import it into the FortiNDR.
   

4. Configure a new Radius Server at User & Authentication -> RADIUS Server as seen in the screenshot below:
   
   

   

   
   

5. Configure a new Radius Administrator as seen in the screenshot below in System -> Administrators:
   
   

   

   
   

Configuration in FortiAuthenticator:

1. Enable the highlighted services as seen in the screenshot below:
   
   

   

   
   

2.  Go to RADIUS Service -> Clients -> Create New, by following the screenshot below:
   
   

   

   
   

3. Go to User Management > Local Users > Create New, by following the screenshot below:
   
   

   

   
   

   
   

   4. Go to User Management -> User Group >- Create New, by following the screenshot below:
      
      

      

      
      

   5. Go to RADIUS Service -> Policies -> Create New, by following the screenshots below:
      
      

      
      

      

      
      

      

      
      

      

      
      
      

6. Login to the FortiNDR over the RADIUS over TLS using the radius admin to check if the account setup is successful.