Fortinet v3.0 MR7 manual Public Key Infrastructure PKI authentication, Peers, Users, User groups

Introduction FortiGate administrator’s view of authentication

Public Key Infrastructure (PKI) authentication

A Public Key Infrastructure (PKI) is a comprehensive system of policies, processes, and technologies working together to enable users of the Internet to exchange information in a secure and confidential manner. PKIs are based on the use of cryptography - the scrambling of information by a mathematical formula and a virtual key so that it can only be decoded by an authorized party using a related key. The public and private cryptographic key pair is obtained and shared through a trusted authority. The public key infrastructure enables the creation of a digital certificate that can identify an individual or organization, and directory services that can store and also revoke the certificates.

Public Key Infrastructure (PKI) authentication utilizes a certificate authentication library that takes a list of ‘peers’, ‘peer’ groups, and/or user groups and returns authentication ‘successful’ or ‘denied’ notifications. Users only need a valid certificate for successful authentication - no username or password are necessary.

Peers

A peer is a user that is a digital certificate holder used in PKI authentication. To use PKI authentication, you must define peers to include in the authentication user group. See “Users/peers” on page 33.

Users

Although it is simpler to define passwords locally, when there are many users the administrative effort to maintain the database is considerable. Users cannot change their own passwords on the FortiGate unit. When a remote or external remote authentication server is part of an enterprise network authentication system, users can change their own passwords. See “Users/peers” on page 33.

Note: Frequent changing of passwords is a good security practice.

User groups

A user group can contain individual users/peers and authentication servers. A user/peer or authentication server can belong to more than one group.

Authentication is group-based. Firewall policies can allow multiple groups access, but authentication for a VPN allows access to only one group. These considerations affect how you define the groups for your organization. Usually you need a user group for each VPN. For firewall policies, you can create user groups that reflect how you manage network privileges in your organization. For example, you might create a user group for each department or create user groups based on functions such as customer support or account management.

You select a protection profile for each user group. Protection profiles determine the level of web filtering, antivirus protection, and spam filtering applied to traffic controlled by the firewall policy to which members of this user group authenticate. For more information about protection profiles, see the FortiGate Administration Guide.

FortiOS v3.0 MR7 User Authentication User Guide
01-30007-0347-20080828	9