FortiGate Administration Guide - FirewallShop.com

System Administrators
Administrators
Figure 91: Administrator account configuration - PKI authentication
Administrator
Type
User Group
Wildcard
Password
Confirm
Password
Trusted Host #1
Trusted Host #2
Trusted Host #3
Access Profile
Enter the login name for the administrator account.
The name of the administrator should not contain the characters
()#"'. Using these characters in the administrator account name can
result in a cross site scripting (XSS) vulnerability.
Select the type of administrator account:
• Regular: Select to create a Local administrator account.
• RADIUS: Select to authenticate the administrator using a RADIUS
server. RADIUS authentication for administrators must be configured
first. See “Configuring RADIUS authentication for administrators” on
page 163.
• PKI: Select to enable certificate-based authentication for the
administrator. Only one configured administrator can have the PKI
option enabled at all times.
If you are using RADIUS or PKI certificate-based authentication, select
the administrator user group that includes the RADIUS server/PKI (peer)
users as members of the User Group. The administrator user group
cannot be deleted once the group is selected for authentication.
Select to allow all accounts on the RADIUS server to be administrators.
This is available only if RADIUS is selected.
Enter a password for the administrator account. For improved security,
the password should be at least 6 characters long.
If RADIUS is enabled, the FortiGate unit attempts RADIUS authentication
first, and if that fails, it attempts password authentication.
This is not available if Wildcard is selected. Not available when PKI
authentication is selected.
Type the password for the administrator account a second time to
confirm that you have typed it correctly.
This is not available if Wildcard is selected. Not available when PKI
authentication is selected.
Optionally, type the trusted host IP address and netmask that
administrator login is restricted to on the FortiGate unit. You can specify
up to three trusted hosts. These addresses all default to 0.0.0.0/0.
Setting trusted hosts for all of your administrators can enhance the
security of your system. For more information, see “Using trusted hosts”
on page 168.
Select the access profile for the administrator. The pre-configured
super_admin profile provides full access to the FortiGate unit. You can
also select Create New to create a new access profile. For more
information on access profiles, see “Configuring an access profile” on
page 172.
FortiGate Version 3.0 MR5 Administration Guide
01-30005-0203-20070830 167