FortiOS Handbook - Deploying Wireless Networks

Configuring user authentication
Configuring a WiFi LAN
WPA2 Enterprise authentication
Enterprise authentication can be based on the local FortiGate user database or on a remote RADIUS server.
Local authentication is essentially the same for WiFi users as it is for wired users, except that authentication for
WiFi users occurs when they associate their device with the AP. Therefore, enterprise authentication must be
configured in the SSID. WiFi users can belong to user groups just the same as wired users and security policies
will determine which network services they can access.
If your WiFi network uses WPA2 Enterprise authentication verified by a RADIUS server, you need to configure the
FortiGate unit to connect to that RADIUS server.
Configuring connection to a RADIUS server - web-based manager
1. Go to User & Device > RADIUS Servers and select Create New.
2. Enter a Name for the server.
This name is used in FortiGate configurations. It is not the actual name of the server.
3. In Primary Server Name/IP, enter the network name or IP address for the server.
4. In Primary Server Secret, enter the shared secret used to access the server.
5. Optionally, enter the information for a secondary or backup RADIUS server.
6. Select OK.
To configure the FortiGate unit to access the RADIUS server - CLI
config user radius
edit exampleRADIUS
set auth-type auto
set server 10.11.102.100
set secret aoewmntiasf
end
To implement WPA2 Enterprise security, you select this server in the SSID security settings. See Configuring user
authentication on page 45.
To use the RADIUS server for authentication, you can create individual FortiGate user accounts that specify the
authentication server instead of a password, and you then add those accounts to a user group. Or, you can add
the authentication server to a FortiGate user group, making all accounts on that server members of the user
group.
Creating a wireless user group
Most wireless networks require authenticated access. To enable creation of firewall policies specific to WiFi
users, you should create at least one WiFi user group. You can add or remove users later. There are two types of
user group to consider:
• A Firewall user group can contain user accounts stored on the FortiGate unit or external authentication servers such
as RADIUS that contain and verify user credentials.
• A Fortinet Single Sign-On (FSSO) user group is used for integration with Windows Active Directory or Novell
eDirectory. The group can contain Windows or Novell user groups who will be permitted access to the wireless LAN.
46 Deploying Wireless Networks for FortiOS 5.4
Fortinet Technologies Inc.