Authentication and User Access
Core concepts
FortiGate authentication spans local users and groups, remote servers (LDAP, RADIUS, TACACS+), and identity-based policy. A user group is what policies reference, not individual users. Understand the difference between firewall authentication (captive portal prompting users) and identity-based policy using detected or authenticated identities. FSSO (Fortinet Single Sign-On) pulls identities from directory agents so policies can match users without prompts.
Methods and traps
Know the authentication methods: local password, LDAP bind, RADIUS, PKI certificates, and MFA (token, email, SMS). A frequent trap is confusing authentication timeout settings with session timeouts, or assuming a user group in a policy authenticates traffic that never triggers a prompt because the source is already identified. Another trap: LDAP vs RADIUS roles-LDAP is commonly used for user lookup/groups, RADIUS for authentication and accounting. Group membership mapping matters: if the remote group name does not match the configured group, policy matching fails.
Two-factor and admin access
Admin accounts are separate from firewall users. Questions may ask how to restrict administrative access by trusted hosts or two-factor. Remember that administrative authentication and user (traffic) authentication are different subsystems with different config paths.
Rule of thumb
When a policy references a user group, ask: how will the FortiGate learn this user's identity? Options are explicit authentication (captive portal), FSSO, or certificate. If none is configured, the policy will not match that user's traffic. For remote groups, verify the group name mapping and the server reachability before troubleshooting policy logic.