FortiAuthenticator Implementation Guide
1. Introduction
FortiAuthenticator provides secure user identity management and authentication for
Fortinet security infrastructure. This document outlines the steps for implementing
FortiAuthenticator in an enterprise environment.
2. Prerequisites
Before starting the implementation, ensure the following:
A licensed FortiAuthenticator appliance (physical or virtual).
Network access to FortiGate, Active Directory (if applicable), and RADIUS clients.
Administrator access to FortiAuthenticator and FortiGate.
A configured FortiGate firewall with VPN or user authentication policies.
3. Deployment Steps
Step 1: Initial Setup of FortiAuthenticator
1. Connect to the FortiAuthenticator GUI via a web browser ([Link] Address>).
2. Login with default credentials:
o Username: admin
o Password: admin
3. Change the default administrator password.
4. Configure network settings under System > Network > Interfaces.
5. Set up DNS and NTP servers under System > Configuration.
Step 2: Integrating with Active Directory (Optional)
1. Navigate to Authentication > Remote Auth. Servers > Create New.
2. Select LDAP Server, enter the AD server details, and test connectivity.
3. Under Authentication > User Management, import users from AD.
Step 3: Configuring RADIUS for Authentication
1. Go to Authentication > RADIUS Service > General and enable RADIUS.
2. Add a new RADIUS client:
o Enter FortiGate IP as the client.
o Set a shared secret for authentication.
3. Configure RADIUS policies to allow specific user groups.
Step 4: Configuring FortiGate for Authentication
1. On FortiGate, navigate to User & Device > RADIUS Servers.
2. Add FortiAuthenticator as a RADIUS server.
3. Configure user groups under User & Device > User Groups.
4. Apply authentication policies in firewall rules or VPN settings.
Step 5: Implementing Two-Factor Authentication (2FA)
1. Enable FortiToken under Authentication > FortiTokens.
2. Assign tokens to users manually or through email/SMS.
3. Configure the FortiGate VPN or captive portal to require 2FA authentication.
4. Test authentication using a VPN or web portal login.
Step 6: Monitoring and Troubleshooting
1. Monitor logs under Logging > Log Access.
2. Check user authentication under Monitor > Authentication Monitor.
3. If authentication fails, verify RADIUS logs and shared secrets.
4. Ensure the time is synchronized between FortiAuthenticator and other devices.
4. Best Practices
Regularly back up the FortiAuthenticator configuration.
Enforce strong password policies and multi-factor authentication.
Monitor logs and set up alerts for failed login attempts.
Periodically update firmware to the latest stable release.
5. Conclusion
By following this implementation guide, FortiAuthenticator will be successfully
integrated into the network, providing secure and centralized authentication
management. For further assistance, refer to the FortiAuthenticator Administrator
Guide or contact support.
config router static
edit 2
set device port1
set dst [Link]/0
set gateway [Link]
next
end
config system interface
edit port1
set ip [Link]/[Link]
set mtu 1500
set allowaccess ssh https-gui
next
end