Technical Tip: Restrict local admin authentication when remote authentication server is running

Description

This article describes how to restrict local admin authentication when a remote authentication server is running.

Scope

FortiGate.

Solution

config system global
    set admin-restrict-local {enable | disable} 
end

Default is set to disabled.

Behavior before FortiOS v7.2.0:
If enabled, as long as any remote server is available on FortiGate (TACACS, LDAP, or RADIUS) and is up and running, local admin authentication will be blocked. Local admins will be allowed access only if no remote server is detected.

Behavior from FortiOS v7.2.0:
If enabled, FortiGate now only checks if all remote authentication servers applied in 'system admin' are down, instead of all remote servers configured on the FortiGate, before allowing local administrators to log in.

Note: This setting applies to FortiGate GUI/CLI (ssh/telnet) access only. In both cases, console access to the FortiGate would still be available using local administrators even if the remote authentication servers are up. 

Behavior from FortiOS v7.6.0:

config system global
    set admin-restrict-local {all | non-console-only | disable} 
end

Default is disabled.  

Related document:

Restrict local administrator logins through the console

Note: The setting of 'all' applies to FortiGate GUI/CLI (ssh/telnet) and console access. If the remote authentication servers are up, the local admin account will not be available; this includes via the console.

In an HA cluster with an HA management interface configured, the local admin user can still access FortiGate on HA management interface IPs (even when 'admin-restrict-local' is set to all) because enabling the HA management interface creates a hidden VDOM: vsys_hamgmt, and the remote authentication server is associated with another VDOM.

Technical Tip: The FortiGate HA hidden VDOMs 'vsys_ha' and 'vsys_hamgmt'

It is by design; in a multi-VDOM environment, it is expected to have the management access interface and RADIUS server associated with the same VDOM.

Behavior from FortiOS v8.0.0:

Specific login channels can now be explicitly blocked, including Console, GUI, SSH, and Telnet. The feature provides granular control over how administrator accounts are allowed to access FortiGate.

This enables direct per-admin, per-method control instead of relying only on global local-admin restriction behavior.

A new option is available under 'config system admin' to explicitly disallow selected login methods for an administrator account.

config system admin​
   edit <admin user>
       set disallowed-login-methods {console | gui | ssh | telnet}
   next
end

Methods listed in disallowed-login-methods are blocked. All login methods not listed remain permitted by default.

Related article:

Technical Tip: How to restrict login method for administrator account