Technical Tip: Remote admin login with RADIUS selecting an admin access account profile

[tbarua]

Description

The article describes how to create an admin profile and set up the RADIUS server with a specific profile for a RADIUS user.

Scope

FortiAnalyzer, FortiAuthenticator.

Solution

1. Configure the FortiAnalyzer with the RADIUS server.

Navigate to System settings -> Remote Authentication -> Create new -> select Radius server from the drop-down menu.

Name: FAC
Server IP/Name: 192.168.2.200
Server Secret: radius_secret

Alternatively, run the equivalent in the CLI: 

config system admin radius
    edit "FAC"               <----- Name of the server object.
        set server "192.168.2.200"        <----- RADIUS server IP address.
        set port 1812                   <----- RADIUS server port.
        set secret radius_secret
    next
end

Create a RADIUS client under Authentication -> RADIUS Service -> Clients by selecting 'Create New'.

Set up an entry that the FortiAnalyzer using FortiAuthenticator will match:

The client IP needs to match the FortiAnalyzer IP.

The secret specified here will need to be set on the FortiAnalyzer as well.

A RADIUS policy can be created under Authentication -> RADIUS Service -> Policies.

During the configuration steps:

1. RADIUS clients: Select the appropriate client.
2. RADIUS attribute criteria: Skip.
3. Authentication type: Select ‘Password/OTP’. 
4. Identity source: Select the preferred realm. The local realm is selected in this example.

Select the specific group where the RADIUS attribute is being set.

5. Authentication factors: Set 'All configured password and OTP factors'.

6. RADIUS response: Skip.

2. Configure the RADIUS server to send the appropriate vendor-specific attributes (VSAs).

   Make sure that the RADIUS server is configured to send the appropriate vendor-specific attributes (VSA). 

   To send an appropriate access profile VSA 6 must be set.

   VENDOR fortinet 12356
   ATTRIBUTE Fortinet-Access-Profile   6   string

   In this example: 

   
   Attribute 6 is set to Super_User.

   

   A list of all of Fortinet's VSA is available here.

3. Create an admin profile.

   Go to System settings -> Admin Profiles and create a profile: 

   Profile name: Super_User

   Access:  Read-Write Only

4. Create an administrator. To do so, go to System settings -> Administrator -> Create new -> Select Administrator. 

   

   Note: Disable 'Match all users on remote' if a specific user is granted admin access through the RADIUS server. In this scenario, the username must correspond to that specific remote user.

5. Log in to FortiAnalyzer using the new RADIUS user.