Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Michal
New Contributor

RADIUS with two groups

Hi all,

I want to create two groups which will be authenticated with RADIUS server with different level of accesibility to the network.

I know that if I creating authentication with LDAP server I can create two groups and associated them with different groups od LDAP server by specifying indyvidual CN.

Could you tell me, if I could to this the same with RADIUS? If yes, how can I do this?

1 Solution
Jeff_FTNT
Staff
Staff

You may set up your Radius server to support Fortinet VSA.

VENDOR		Fortinet	12356

BEGIN-VENDOR Fortinet
ATTRIBUTE Fortinet-Group-Name 1 string
ATTRIBUTE Fortinet-Client-IP-Address 2 ipaddr
ATTRIBUTE Fortinet-Vdom-Name 3 string
ATTRIBUTE Fortinet-Client-IPv6-Address 4 octets
ATTRIBUTE Fortinet-Interface-Name 5 string
ATTRIBUTE Fortinet-Access-Profile 6 string

#
# Integer Translations
#

END-VENDOR Fortinet


FGT can check the return "Fortinet-Group-Name" value "radius_group1" to do group match
config user group
    edit "group_radius"
        set member "vdom1rad"
            config match
                edit 1
                    set server-name "vdom1rad"
                    set group-name "radius_group1"
                next
            end
    next
end

View solution in original post

3 REPLIES 3
Jeff_FTNT
Staff
Staff

You may set up your Radius server to support Fortinet VSA.

VENDOR		Fortinet	12356

BEGIN-VENDOR Fortinet
ATTRIBUTE Fortinet-Group-Name 1 string
ATTRIBUTE Fortinet-Client-IP-Address 2 ipaddr
ATTRIBUTE Fortinet-Vdom-Name 3 string
ATTRIBUTE Fortinet-Client-IPv6-Address 4 octets
ATTRIBUTE Fortinet-Interface-Name 5 string
ATTRIBUTE Fortinet-Access-Profile 6 string

#
# Integer Translations
#

END-VENDOR Fortinet


FGT can check the return "Fortinet-Group-Name" value "radius_group1" to do group match
config user group
    edit "group_radius"
        set member "vdom1rad"
            config match
                edit 1
                    set server-name "vdom1rad"
                    set group-name "radius_group1"
                next
            end
    next
end
Michal
New Contributor

Thank You.

But I wanna ask what if I couldn't change RADIUS settings?

I think about something like this:

I will create local user account on Fortigate but instruct to check password on RADIUS server.

Then I will associate the policy with this user/users.

 

 

norouzi
Contributor

1-Create a remote radius group.

2-Create a user and enable "match user on RADIUS server" with the name of radius settings

3-Create different user groups with your local users

 

In this case for authentication users should be exist in FortiGate Local User and also in Radius server and password will be used from radius server.

 

 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors