FortiGate Administration Guide - FirewallShop.com

Administrators
System Administrators
Configuring PKI certificate authentication for administrators
Public Key Infrastructure (PKI) authentication utilizes a certificate authentication
library that takes a list of ‘peers’, ‘peer’ groups, and/or user groups and returns
authentication ‘successful’ or ‘denied’ notifications. Users only need a valid
certificate for successful authentication - no username or password are necessary.
If you want to use PKI authentication for an administrator, you must configure the
authentication before you create the administrator accounts. To do this you need
to:
• create a PKI user group
The following procedures assume that there is a RADIUS server on your network
populated with the names and passwords of your administrators. For information
on how to set up a RADIUS server, see the documentation for your RADIUS
server.
Go to User > PKI to configure PKI users.
Figure 87: User > PKI user list
Create New
User Name
Subject
Issuer
Delete icon
Edit icon
Add a new PKI user.
The name of the PKI user.
The text string that appears in the subject field of the certificate of
the authenticating user.
The CA certificate that is used to authenticate this user.
Delete this PKI user.
Edit this PKI user.
Note: The following fields in the PKI User List correspond to the noted fields in the PKI
User dialog:
User Name: Name
Subject: Subject
CA: Issuer (CA certificate)
To configure the FortiGate unit to access the RADIUS server
1 Go to User > RADIUS.
2 Select Create New.
3 Enter the following information:
Name
A name for the RADIUS server. You use this name when you create the
user group.
Server Name/IP The domain name or IP address of the RADIUS server.
Server Secret The RADIUS server secret. The RADIUS server administrator
can provide this information.
4 Select OK.
FortiGate Version 3.0 MR5 Administration Guide
164 01-30005-0203-20070830