Description
The article describes how to modify VDOM attribute while login as a Remote admin user in FortiGate.
Scope
FortiGate, FortiAuthenticator.
Solution
- Configure the FortiGate with the FortiAuthenticator as a Remote RADIUS server. For details and a step-by-step procedure, see this article.
For example:
- Configure the RADIUS server to send the appropriate vendor-specific attributes (VSAs).
Ensure that the RADIUS server is configured to send the appropriate vendor-specific attributes (VSA).
In order to send a specific group membership and access profile, VDOM VSA 1, VSA 6, VSA 3 must be set.
VENDOR fortinet 12356
ATTRIBUTE Fortinet-Group-Name 1 string
ATTRIBUTE Fortinet-Access-Profile 6 string
ATTRIBUTE Fortinet-Vdom-Name 3 string
In this example:
Attribute 1 is set to remote_admins.
Attribute 6 is set to Super_admin.
Attribute 3 is set to vdomtest1
A list of all of Fortinet's VSA is available here.
- Create a User group on FortiGate
Go to User & Device -> User -> User group and create a Firewall group.
Create a New Remote Server and add the RADIUS Server.
In the group's field, include the string that was configured as attribute 1 on the RADIUS server.
In this example, the string used was ‘group’.
Name: Remote_Admin
Remote group:
Remote Server: fac.fortiad.net
Group Name: group
- It is mandatory to have VDOM set up as a prerequisite for this example. See the related article on how to set up VDOM in FortiGate.
Next steps:
- Create an admin user in FortiGate:
- Go to System -> Administrators -> Create new -> Select Administrators.
- Create a new admin with the type 'Match all users in a remote server group'.
- Select the User Group.
- Select super_admin profile as an Administrator profile.
Log into FortiGate using the new RADIUS user.
FortiAuthenticator debug will show the RADIUS attribute for the specific VDOM:
22024-11-04T17:37:22.498844+02:00 fac radiusd[3512]: (7) Sent Access-Accept Id 58 from 192.168.2.100:1812 to 192.168.2.254:18184 length 87
2024-11-04T17:37:22.498875+02:00 fac radiusd[3512]: (7) Message-Authenticator := 0x00
2024-11-04T17:37:22.498885+02:00 fac radiusd[3512]: (7) Fortinet-Group-Name += "group"
2024-11-04T17:37:22.498895+02:00 fac radiusd[3512]: (7) Fortinet-Access-Profile += "super_admin"
2024-11-04T17:37:22.498912+02:00 fac radiusd[3512]: (7) Fortinet-Vdom-Name += "vdomtest1"
Related article:
Multi VDOM configuration examples - FortiGate administration guide
