Subject, Authenticating peer user | Fortinet v3.0 MR7 specification


Users/peers and user groups	Users/peers

•a peer user name

•the text from the subject field of the certificate of the authenticating peer user, or the CA certificate used to authenticate the peer user. You can configure a peer user with no values for the subject and certificate fields. This user behaves like a user account or policy that is disabled.

Note: If you create a PKI user in the CLI with no values in subject or ca, you will not be able to open the user record in the GUI, or you will be prompted to add a value in Subject (subject) or CA (ca).

To create a peer user for PKI authentication - web-based manager

1Go to User > PKI.

2Select Create New, enter the following information, and select OK.

Figure 15: PKI peer user configuration

Note: Even though Subject and CA are optional fields, one of them must be set.

Name	Enter the name of the PKI peer user. This field is mandatory.
Subject	Enter the text string that appears in the subject field of the
	certificate of the authenticating peer user. This field is optional.
CA	Enter the CA certificate that must be used to authenticate this peer
	user. This field is optional.

To view a list of PKI peer users, go to User > PKI.

Figure 16: PKI peer user list

Create New	Add a new PKI peer user.
User Name	The name of the PKI peer user.
Subject	The text string that appears in the subject field of the certificate of
	the authenticating peer user.

FortiOS v3.0 MR7 User Authentication User Guide
01-30007-0347-20080828	37

Image 37

Fortinet v3.0 MR7 manual To view a list of PKI peer users, go to User PKI, Subject, Authenticating peer user

Contents

E R G U I D E Trademarks FortiOS v3.0 MR7 User Authentication User Guide Contents Users/peers and user groups Configuring authenticated accessIndex Creating local users Creating peer users Introduction About authentication Web-based user authentication User’s view of authenticationVPN client-based authentication See Creating local users on See Creating peer users on FortiGate administrator’s view of authentication See Configuring user groups on Authentication servers Peers Public Key Infrastructure PKI authenticationUsers User groups About this document Authentication timeoutFirewall policies VPN tunnels FortiGate documentation Name field, type adminTypographic conventions Related documentation FortiGate Administration Guide FortiClient documentation FortiManager documentationFortiMail documentation FortiAnalyzer documentation Fortinet Tools and Documentation CD Customer service and technical supportFortinet Knowledge Center Comments on Fortinet technical documentation Radius servers Authentication servers Radius attributes sent in Radius accounting message Configuring the FortiGate unit to use a Radius server Primary Server Secret Primary Server Name/IP Group Edit icon Edit a Radius server configuration Ldap servers Ldapsearch -x objectclass= Configuring the FortiGate unit to use an Ldap server Server Port PasswordCommon Name Identifier Edit To configure the FortiGate unit for Ldap authentication CLIProtocol Certificate Ldap server Distinguished Name Query tree Using the Query icon Ascii TACACS+ servers Server Key Authentication Type Directory Service servers Domain Create NewGroups Fsae Collector IP Fsae Collector IP/Name Port Directory Service server configuration Name CLI Example Directory Service server list Directory Service servers Users/peers Users/peers and user groups Creating local users User type AuthenticationTo create a local user web-based manager Go to User Local Delete icon Edit icon To view a list of all local users, go to User LocalTo create a local user CLI Creating peer users To remove a user from the FortiGate unit configuration CLIDelete icon To view a list of PKI peer users, go to User PKI Authenticating peer userSubject Remove PKI peer user To create a peer user for PKI authentication CLI User groups Directory Service user groupsFirewall user groups Protection profiles SSL VPN user groups Select Create New and enter the following information Configuring user groupsFirewall To create a firewall user group CLI Configuring Directory Service user groupsMembers FortiGuard Web Available Users/Groups or Available Members Configuring SSL VPN user groups Viewing a list of user groups Configuring Peer user groupsTo create a peer group CLI Group Name Config user group delete groupname End User groups Authentication protocols Authentication timeoutEnter the Idle Timeout value seconds Select Apply Telnet Authentication Settings Firewall policy authentication Authentication is an Advanced firewall option Configuring authentication for a firewall policyTo configure authentication for a firewall policy Go to Firewall Policy Firewall Policy Move To Firewall policy order Source Interface Configuring authenticated access to the InternetZone Configuring authentication of SSL VPN users VPN authenticationSelect Enable SSL-VPN and enter information as follows Go to VPN SSL Server Certificate Default RC4128Require Client Certificate Encryption Key Algorithm To configure authentication for an SSL VPN CLI Configuring authentication of Pptp VPN users/user groups Configuring authentication of VPN peers and clientsSelect Enable Pptp Select Require Client Certificate, and then select Apply Configuring authentication of remote IPSec VPN users Configuring authentication of L2TP VPN users/user groupsTo configure authentication for a Pptp VPN CLI To configure authentication for an L2TP VPN CLI Only users with passwords on the FortiGate unit To configure user group authentication for dialup IPSec CLIRemote Gateway IPSec configuration for dialup users Configuring XAuth authentication Remote Gateway Authentication Method To configure authentication for a dialup IPSec VPN CLIXAuth Server Type VPN authentication Index 01-30007-0347-20080731 MS-CHAP VSA