New Member

Question

[fortigate] Authentication attempt sequence when using a Multi remote authentication server?

Forum|Forum|2 years ago
December 14, 2023
7 replies
3647 views

Fortigate version 6.4.14

When setting up an administrator account through a remote authentication server.
Remote authentication server, LDAP, RADIUS, TACACS+, Local.

Is there a sequence for authentication attempts?
Or can I set the order of authentication attempts?

I wonder.
thank you

FortiGate

ozkanaltas

Valued Contributor III

Hello @H_DY ,

In my opinion, the sequence is related to your group configuration. When you create a remote group you can select which is the first authentication method for your admin user. When the admin user tries to login, Fortigate will processes this request based on your group configuration.

H_DYAuthor

New Member

@ozkanaltas
Thanks for answering my question.

FW1 # config user group
FW1 (group) # edit "ldap_tacacs_radius"
FW1 (ldap_tacacs_radius) # show
config user group
edit "ldap_tacacs_radius"
set member "ldap_test" "TACACS-SERVER" "radius_user"
next
end

FW1 # config system admin
FW1 (admin) # edit "remote-auth"
FW1 (remote-auth) # show
config system admin
edit "remote-auth"
set remote-auth enable
set accprofile "super_admin"
set vdom "root"
set wildcard enable
set remote-group "ldap_tacacs_radius"
next
end

In the above settings, is the priority ldap > tacacs > radius?

H_DYAuthor

New Member

q

ozkanaltas

Valued Contributor III

Hello @H_DY,

In my opinion, yes Fortigate processes your request with this sequence. You can test this easily.

Try to login with ldap first and than change your ldap configuration with the wrong information for example change the user password in your ldap configuration. After that, try to login again. If Fortigate process your login request with a tacacs, this indicates that it works this way.

H_DYAuthor

New Member

Thank you for your reply.
I will test it as you suggested.
I will leave the test results.

Sheikh

Staff

Hello @H_DY,

Just to add that incase of multiple LDAP servers (I mean separate LDAP entries in FortiGate), there might be some authentication issues. In this case FortiGate will send authentication request to all the LDAP servers for the same credentials. Generally it would work and the user will be authenticated, but if the credentials are not correct, then FortiGate will send wrong credentials twice or even more (depends upon how many LDAP servers entries are in the LDAP configs).

To avoid this issue, better to add "secondary and tertiary server" in the one single LDAP entry.

config user ldap
    edit "dc01"
        set server "X.X.X.X"
        set secondary-server "X.X.X.X" <-----------2nd ldap server

  set tertiary-server "X.X.X.X" <--------------3rd ldap server
        set cnid "sAMAccountName"
        set dn "dc=testt,dc=local"
        set type regular
        set username "administrator\\ldapadmin"
        set password <password>
    next
end

regards,

Sheikh

If you have found a solution, please like and mark it as solved to make it easily accessible for everyone.

Sign up

Login with SSO

Login to the community

Login with SSO