How can I set my primary authentication as Radius and secondary as Local

4 replies
1869 views

I have integrated my fortigate with the Radius server and working fine,but parallely my local authentication is also working,how shall i set my radius authetication as primary and local as secondary.

FortiGate

SivasakthiAnswer

New Member

After entering the below commands i can be able to set the Radius as primary authentication and while the radius is enabled the local user credentials are not working as i want and so in the absence of radius server my local user credentials are usable.

config system global
set admin-restrict-local disable
set admin-restrict-local enable
end

rbraha

Staff

Hi @Sivasakthi

By default FGT will check for every request ,local database first if the user is not found there, then whichever server reply first Radius,Ldap it will proceed further to authenticate users. Probably you could use Realms on SSLVPN setting ,this need to be enabled on Feature visibilities.

Please check the below documentation which explain in detail authentication process .

https://community.fortinet.com/t5/FortiGate/Technical-Tip-A-quick-guide-to-FortiGate-SSL-VPN-authentication/ta-p/202041

srajeswaran

Staff

I think the best approach will be to keep just 1 or 2 local admin accounts and remaining users to use remote login.
or you can configure all accounts as remote/radius and while configuring radius user itself it will ask to specify backup password to use in case radius is not reachable.

SivasakthiAuthorAnswer

New Member

After entering the below commands i can be able to set the Radius as primary authentication and while the radius is enabled the local user credentials are not working as i want and so in the absence of radius server my local user credentials are usable.

config system global
set admin-restrict-local disable
set admin-restrict-local enable
end