FortiGate Administration Guide - FirewallShop.com

Administrators
System Administrators
To configure an administrator account
1 Go to System > Admin > Administrators.
2 Select Create New to add an administrator account or select the Edit icon to make
changes to an existing administrator account.
3 In the Administrator field, type a login name for the administrator account.
If you are using RADIUS authentication for this administrator but not using the
wildcard option, the administrator name must match an account on the RADIUS
server.
4 Select the type of authentication:
If you are using RADIUS authentication for this administrator:
• Select RADIUS.
• Select Wildcard if you want all accounts on the RADIUS server to be
administrators of this FortiGate unit.
• Select the administrators user group from the User Group list.
If you are using PKI certificate-based authentication for this administrator:
• Select PKI.
• Select the administrators user group from the User Group list.
5 Type and confirm the password for the administrator account.
This step does not apply if you are using RADIUS Wildcard or PKI certificatebased
authentication.
6 Optionally, type a Trusted Host IP address and netmask from which the
administrator can log into the web-based manager.
7 Select the access profile for the administrator.
8 Select OK.
Using trusted hosts
Setting trusted hosts for all of your administrators increases the security of your
network by further restricting administrative access. In addition to knowing the
password, an administrator must connect only through the subnet or subnets you
specify. You can even restrict an administrator to a single IP address if you define
only one trusted host IP address with a netmask of 255.255.255.255.
When you set trusted hosts for all administrators, the FortiGate unit does not
respond to administrative access attempts from any other hosts. This provides the
highest security. If you leave even one administrator unrestricted, the unit accepts
administrative access attempts on any interface that has administrative access
enabled, potentially exposing the unit to attempts to gain unauthorized access.
The trusted hosts you define apply both to the web-based manager and to the CLI
when accessed through telnet or SSH. CLI access through the console connector
is not affected.
The trusted host addresses all default to 0.0.0.0/0. If you set one of the 0.0.0.0/0
addresses to a non-zero address, the other 0.0.0.0/0 will be ignored. The only way
to use a wildcard entry is to leave the trusted hosts at 0.0.0.0/0. However, this is
an unsecure configuration.
FortiGate Version 3.0 MR5 Administration Guide
168 01-30005-0203-20070830