Configure a RADIUS Authentication Object

Step 1

In the External Authentication Object page, select RADIUS from the Authentication Method drop-down list and enter appropriate values in these fields:

1. Check the Enabled Message Authenticator check box to require the Message-Authenticator attribute in all RADIUS responses, ensuring that every response from the RADIUS server is securely verified by the Firewall Threat Defense.

   This feature is enabled by default for new RADIUS servers. We recommend you enable it for existing servers after the upgrade. Disabling message authenticators may expose your firewalls to potential attacks. Ensure that your RADIUS server has the Message-Authenticator configuration.

2. Define users on the RADIUS server using the Service-Type attribute.

   This is the list of supported values for the Service-Type attribute:

   • Administrator (6)—Provides Config access authorization to the CLI. These users can use all commands in the CLI.

   • NAS Prompt (7) or any level other than 6—Provides Basic access authorization to the CLI. These users can use read-only commands, such as show commands, for monitoring and troubleshooting purposes.

   The names must be Linux-valid usernames:

   • Maximum 32 alphanumeric characters, plus hyphen (-) and underscore (_)

   • All lowercase

   • Cannot start with hyphen (-); cannot be all numbers; cannot include a period (.), at sign (@), or slash (/)

   Alternatively, you can predefine users in the external authentication object (see Step t_configure_external_authentication_623_and_later_2.html#task_hx5_5hy_1cb__step_Shell_Access_Filter). To use the same RADIUS server for the Firewall Threat Defense and Cloud-Delivered Firewall Management Center while using the Service-Type attribute method for the Firewall Threat Defense, create two external authentication objects that identify the same RADIUS server: one object includes the predefined CLI Access Filter users (for use with the Cloud-Delivered Firewall Management Center), and the other object leaves the CLI Access Filter empty (for use with Firewall Threat Defenses).

3. Enter a Name and optional Description.

Step 2

For the Primary Server, enter a Host Name/IP Address.

Step 3

(Optional) Change the Port from the default.

Step 4

Enter a RADIUS Secret Key.

Step 5

(Optional) Enter the Backup Sever parameters.

Step 6

Enter RADIUS-Specific Parameters.

Step 7

(Optional) Enter a comma-separated list of usernames in the Administrator CLI Access User List field. For example, enter jchrichton, aerynsun, rygel.

Step 8

Click Save.