How can I set my primary authentication as Radius and secondary as Local

[Sivasakthi]

I have integrated my fortigate with the Radius server and working fine,but parallely my local authentication is also working,how shall i set my radius authetication as primary and local as secondary.

[Sivasakthi · Accepted solution]

After entering the below commands i can be able to set the Radius as primary authentication and while the radius is enabled the local user credentials are not working as i want and so in the absence of radius server my local user credentials are usable.

config system global
set admin-restrict-local disable
set admin-restrict-local enable 
end

[rbraha]

Hi @Sivasakthi 

By default FGT will check for every request ,local database first if the user is not found there, then whichever server reply first Radius,Ldap it will proceed further to authenticate users. Probably you could use Realms on SSLVPN setting ,this need to be enabled on Feature visibilities.

Please check the below documentation which explain in detail authentication process .

https://community.fortinet.com/t5/FortiGate/Technical-Tip-A-quick-guide-to-FortiGate-SSL-VPN-authent...

[srajeswaran]

I think the best approach will be to keep just 1 or 2 local admin accounts and remaining users to use remote login.
or you can configure all accounts as remote/radius and while configuring radius user itself it will ask to specify backup password to use in case radius is not reachable.

[Sivasakthi · Accepted solution]

After entering the below commands i can be able to set the Radius as primary authentication and while the radius is enabled the local user credentials are not working as i want and so in the absence of radius server my local user credentials are usable.

config system global
set admin-restrict-local disable
set admin-restrict-local enable 
end

[srajeswaran · Accepted solution]

Adding below article explaining the details for the benefit  of other users who may hit this.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Restrict-local-admin-authentication-when-r...