Fortinet v3.0 MR7 manual Server Certificate, Require Client Certificate, Encryption Key Algorithm

Page 53


Configuring authenticated access	VPN authentication

Server Certificate	Select the signed server certificate to use for
	authentication purposes. If you leave the default setting
	(Self-Signed), the FortiGate unit offers its factory
	installed (self-signed) certificate from Fortinet to remote
	clients when they connect.
Require Client Certificate	If you want to enable the use of group certificates for
	authenticating remote clients, select the check box.
	Afterward, when the remote client initiates a connection,
	the FortiGate unit prompts the client for its client-side
	certificate as part of the authentication process.
Encryption Key Algorithm	Select the algorithm for creating a secure SSL
	connection between the remote client web browser and
	the FortiGate unit.
Default - RC4(128	If the web browser on the remote client can match a
bits) and higher	cipher suite greater than or equal to 128 bits, select this
	option.

High - AES(128/256 bits) and 3DES

Low - RC4(64 bits),

DES and higher

Idle Timeout

If the web browser on the remote client can match a high level of SSL encryption, select this option to enable cipher suites that use more than 128 bits to encrypt data.

If you are not sure which level of SSL encryption the remote client web browser supports, select this option to enable a cipher suite greater than or equal to 64 bits.

Type the period of time (in seconds) to control how long the connection can remain idle before the system forces the user to log in again. The range is from 10 to 28800 seconds. You can also set the value to 0 to have no idle connection timeout. This setting applies to the SSL VPN session. The interface does not time out when web application sessions or tunnels are up.

Portal Message	If you want to display a custom caption at the top of the
	web portal home page, type the message.

Advanced (DNS and WINS Servers)

DNS Server #1

DNS Server #2

WINS Server #1

WINS Server #2

Apply

Enter up to two DNS Servers to be provided for the use of clients.

Enter up to two WINS Servers to be provided for the use of clients.

Select to save and apply settings.

FortiOS v3.0 MR7 User Authentication User Guide
01-30007-0347-20080828	53

Image 53

Contents E R G U I D E Trademarks FortiOS v3.0 MR7 User Authentication User GuideContents Users/peers and user groups Configuring authenticated accessIndex Creating local users Creating peer usersIntroduction About authenticationVPN client-based authentication User’s view of authenticationWeb-based user authentication See Creating local users on See Creating peer users on FortiGate administrator’s view of authenticationSee Configuring user groups on Authentication serversPeers Public Key Infrastructure PKI authenticationUsers User groupsAbout this document Authentication timeoutFirewall policies VPN tunnelsTypographic conventions Name field, type adminFortiGate documentation Related documentation FortiGate Administration GuideFortiClient documentation FortiManager documentationFortiMail documentation FortiAnalyzer documentationFortinet Tools and Documentation CD Customer service and technical supportFortinet Knowledge Center Comments on Fortinet technical documentationRadius servers Authentication serversRadius attributes sent in Radius accounting message Configuring the FortiGate unit to use a Radius serverPrimary Server Secret Primary Server Name/IPGroup Edit icon Edit a Radius server configurationLdap servers Ldapsearch -x objectclass= Configuring the FortiGate unit to use an Ldap server Server Port PasswordCommon Name IdentifierEdit To configure the FortiGate unit for Ldap authentication CLIProtocol CertificateLdap server Distinguished Name Query tree Using the Query iconAscii TACACS+ serversServer Key Authentication TypeDirectory Service servers Domain Create NewGroups Fsae Collector IPFsae Collector IP/Name Port Directory Service server configuration NameCLI Example Directory Service server list Directory Service servers Users/peers Users/peers and user groupsTo create a local user web-based manager Go to User Local User type AuthenticationCreating local users To create a local user CLI To view a list of all local users, go to User LocalDelete icon Edit icon Delete icon To remove a user from the FortiGate unit configuration CLICreating peer users Subject Authenticating peer userTo view a list of PKI peer users, go to User PKI Remove PKI peer user To create a peer user for PKI authentication CLIFirewall user groups Directory Service user groupsUser groups Protection profiles SSL VPN user groupsFirewall Configuring user groupsSelect Create New and enter the following information To create a firewall user group CLI Configuring Directory Service user groupsMembers FortiGuard WebAvailable Users/Groups or Available Members Configuring SSL VPN user groupsViewing a list of user groups Configuring Peer user groupsTo create a peer group CLI Group NameConfig user group delete groupname End User groups Authentication protocols Authentication timeoutEnter the Idle Timeout value seconds Select Apply TelnetAuthentication Settings Firewall policy authenticationAuthentication is an Advanced firewall option Configuring authentication for a firewall policyTo configure authentication for a firewall policy Go to Firewall PolicyFirewall Policy Move To Firewall policy orderZone Configuring authenticated access to the InternetSource Interface Configuring authentication of SSL VPN users VPN authenticationSelect Enable SSL-VPN and enter information as follows Go to VPN SSLServer Certificate Default RC4128Require Client Certificate Encryption Key AlgorithmTo configure authentication for an SSL VPN CLI Configuring authentication of Pptp VPN users/user groups Configuring authentication of VPN peers and clientsSelect Enable Pptp Select Require Client Certificate, and then select ApplyConfiguring authentication of remote IPSec VPN users Configuring authentication of L2TP VPN users/user groupsTo configure authentication for a Pptp VPN CLI To configure authentication for an L2TP VPN CLIRemote Gateway To configure user group authentication for dialup IPSec CLIOnly users with passwords on the FortiGate unit IPSec configuration for dialup users Configuring XAuth authenticationRemote Gateway Authentication Method To configure authentication for a dialup IPSec VPN CLIXAuth Server TypeVPN authentication Index 01-30007-0347-20080731 MS-CHAP VSA