FortiAuthenticator — RADIUS, TACACS+ and MFA with AD

You already built a Tiering model: critical access only from a PAW and only for Tier 0. One question stayed open — how does the infrastructure verify an admin's identity? VPN, firewall logins, Wi-Fi and switches all need authentication, ideally against the same AD and with a second factor.

• FortiAuthenticator (FAC) syncs with AD over LDAP(S) and knows domain users and groups.
• Acts as a RADIUS server — for VPN, Wi-Fi and 802.1X.
• Acts as a TACACS+ server — for admin logins to network devices, including the FortiGates themselves.
• Adds MFA (FortiToken Mobile / push, TOTP, SMS) on top of domain authentication.

Related topics in this course

• Tiering and PAW — admin login to network gear belongs to Tier 0 and requires MFA.
• Kerberos vs NTLM — the password is validated against AD, so the password weaknesses from that module apply to VPN too.

RADIUS vs TACACS+

• Transport: RADIUS over UDP, TACACS+ over TCP.
• Encryption: RADIUS encrypts only the password, TACACS+ encrypts the whole payload.
• Usage: RADIUS for VPN/Wi-Fi/802.1X, TACACS+ for network device logins.
• Authorization: limited in RADIUS (attributes), granular per command and role in TACACS+.

MFA flow: the user enters domain credentials → FAC validates them against AD over LDAP → FAC sends a push to FortiToken on the phone → access is granted only after approval.

Lab practice

• Connect FAC to AD: System → Authentication → Remote Auth. Servers → LDAP → New. Set the DC, search base DC=corp,DC=local and a plain read-only account (never an admin). Then User Management → User Groups, bound to CN=NetAdmins.
• RADIUS: on FAC under Authentication → RADIUS Service → Clients → New set the FortiGate IP and a long shared secret.

config user radius
    edit "FortiAuth-RADIUS"
        set server "10.0.0.20"
        set secret <shared-secret>
    next
end

TACACS+ for admin logins to FortiGate (and the lab switches):

config user tacacs+
    edit "FortiAuth-TACACS"
        set server "10.0.0.20"
        set key <shared-secret>
    next
end

config system admin
    edit "netadmin1"
        set remote-auth enable
        set remote-auth-server "FortiAuth-TACACS"
        set accprofile "super_admin"
    next
end

MFA: on FAC enable FortiToken for the NetAdmins group and bind the first token (QR code in the mobile app). For a lab, FAC ships with 2 free FortiToken Mobile licences — enough for a demo.

Risks and detection

• The RADIUS/TACACS+ shared secret sits in the config; weak or leaked, it lets an attacker stand up a rogue RADIUS client. Keep it in a password manager and rotate quarterly.
• FAC's LDAP account: read-only on the required OUs; 4624/4648 events from it outside work hours deserve a look.
• Automatic fallback to a local password is a hole: knock FAC over and log in locally. Instead keep a break-glass account with a long random password in a safe.
• FAC logs are a great detection source: failed logins, push denials, odd-hour logons. Ship them to a SIEM.

Mitigation

• TACACS+ for all administrative access; RADIUS only for user scenarios.
• MFA is mandatory for NetAdmins and VPN access.
• Read-only LDAP account, secrets in a safe, quarterly rotation.
• Break-glass: one local account per device, password in a safe, any use is an incident to review.