Firewall Authentication Flashcards
What are the three firewall auth methods for users?
Local password
Server based (ldap, radius, pop3, tacas+)
Two-factor
What auth servers does FG support?
POP3, RADIUS, LDAP, TACACS+
Can POP3 servers be configured in GUI?
No, CLI only
What does DSA Stand for
Directory System AGENT
LDAP port
389
What is Common Name Identifier?
Used to find the username i.e. sAMAccountName or cn for LDAP
What is the Distinguished Name setting for LDAP?
Identifies the top of the tree where the users are located, generally the dc value but could be container or ou.
What protocols does secure LDAP use
LADPS or STARTTLS
What is Access-Request?
The request that FG sends to RADIUS to auth a user.
What is Access-Accept for Radius?
User credentials are ok
What is Access-Reject for Radius?
User credentials are wrong
What is Access-Challenge?
Radius server for secondary password ID, token, or certificate. (two factor) Not supported by all devices.
What should you deploy to help keep OTP in sync?
A NTP server.
What is used to generate a OTP?
Seed + Time
Can you register a FortiToken to more than on FortiGate?
No, only one, you must use FortiAuthenticator if you wish to use the same FortiToken Across multiple FG
What are examples of passive authentication?
Forti SSO
RSSO
NTLM
What does RSSO stand for?
RADIUS Single Sign-on
What type of user groups are there?
Firewall
Guest
FSSO
RSSO
Should you allow DNS to run before your user is authenticated?
Yes, as it is usually required to resolve host names prior to authentication being triggered.
What protocols can be used to trigger active authentication in a firewall policy
HTTPS
HTTP
FTP
Telnet
When using active and passive policies together, what is meant to be the primary authentication method?
Passive.
What CLI command enables you to force FortiGate to trigger an auth request?
Config user setting
Set auth-on-demand <Always | Implicit>
Implicit lets traffic through if there is a fall through policy
Always triggers auth regardless of their being a fall through policy.
What CLI command is used to force auth timeout
Config user setting
set auth-timeout-type
[ Idle-time out | Hard-timeout | new-session]
Where on the GUI do you monitor users?
Dashboard> User & Devices > Firewall Users
