RADIUS Authentication Configuration: Server and User Group
An administrator needs to authenticate users on a FortiGate using RADIUS. Which TWO of the following are required to configure RADIUS authentication?
Quick Answer
The answer is a user group that references the RADIUS server. This is required because FortiGate does not authenticate users directly against a RADIUS server; instead, it must first define the RADIUS server object with its IP address and shared secret, then bind that server to a user group to enforce authentication policies. On the Fortinet NSE 4 Network Security Professional NSE4 exam, this concept tests your understanding of the RADIUS authentication configuration steps, where a common trap is assuming a firewall policy alone can authenticate users without a user group. The exam often presents a distractor like “a firewall policy that permits RADIUS traffic,” but the critical missing piece is the user group that references the RADIUS server. Remember the memory tip: “Server first, then group—no group, no login.”
⚠ Common exam trap
It's easy for candidates to think a local user account is required for each RADIUS user, but RADIUS offloads authentication to an external server, making local accounts unnecessary.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A RADIUS server object with IP address and shared secret
A RADIUS server object defines the IP address and shared secret that the FortiGate uses to communicate with the RADIUS server for authentication requests. Option D is correct because a user group must reference the RADIUS server to map authenticated users to policies; without this group, the FortiGate cannot apply firewall rules based on RADIUS authentication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A PKI certificate for the RADIUS server
Why it's wrong here
Certificates are optional for RADIUS authentication.
- ✓
A RADIUS server object with IP address and shared secret
Why this is correct
This defines the connection to the RADIUS server.
- ✗
An FSSO connector
Why it's wrong here
FSSO is for Active Directory polling, not RADIUS.
- ✓
A user group that references the RADIUS server
Why this is correct
The user group is used in policies for authentication.
- ✗
A local user account for each RADIUS user
Why it's wrong here
RADIUS users are not stored locally.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate administrator is configuring RADIUS authentication for firewall users. Which THREE steps are required to complete the configuration? (Select THREE.)
medium- A.Import the RADIUS server certificate into FortiGate
- ✓ B.Configure a firewall policy with the user group set in 'users/groups'
- ✓ C.Define the RADIUS server under 'config user radius'
- ✓ D.Create a user group that uses the RADIUS server as the authentication source
- E.Enable 'set auth-type radius' on the interface
Why B: A firewall policy must reference the user group that uses the RADIUS server as its authentication source. Without this policy configuration, RADIUS-authenticated users cannot match the policy and will be denied access. The 'users/groups' field in the firewall policy is where the user group object is specified to enforce authentication-based access control.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.