There are three participants in this communication: Supplicant (end host) <-> Authenticator (FGT) <-> Auth. Server (RADIUS server).
The role of the authenticator (FGT/FAP) is just to translate the requests from EAPoL to RADIUS without worrying too much about the method used. Most of the related configurations are done in the Supplicant and the RADIUS server.
The methods have pros and cons, PEAP/MSCHAPv2 is more popular in windows hosts and EAP-TLS is the most secure, some of them are deprecated.
I understand, and thanks for the link. So of course it is also client dependent what this understands. Thought it always had also still effect how well and how fast a device can log on.
In principle, if I understand correctly, logging in directly via Fortigate is not the best idea, since everything has to be transmitted in plain text. But that also means it doesn't matter which of my 3 methods I use. Right?
Basically yes, RADIUS server is always recommended, FortiAuthenticator for example can offers a scalable solution. You can aim for the most secure one EAP-TLS (user certificate based).
Anyway even if you are using EAP-TTLS/PAP (that is passing the traffic in clear text in inner tunnel) this is still secure because the information is exchanged via the EAP tunnel that encrypts the traffic with TLS. You have to configure manually the supplicant on end devices and be careful to select only the trusted domain and CA to avoid any "honey pot" scenario.
- Emirjon If you have found a solution, please like and accept it to make it easily accessible for others.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.