RADIUS Authentication Configuration: Server and User Group
An administrator needs to authenticate users on a FortiGate using RADIUS. Which TWO of the following are required to configure RADIUS authentication?
Quick Answer
The answer is a user group that references the RADIUS server. This is required because FortiGate does not authenticate users directly against a RADIUS server; instead, it must first define the RADIUS server object with its IP address and shared secret, then bind that server to a user group to enforce authentication policies. On the Fortinet NSE 4 Network Security Professional NSE4 exam, this concept tests your understanding of the RADIUS authentication configuration steps, where a common trap is assuming a firewall policy alone can authenticate users without a user group. The exam often presents a distractor like “a firewall policy that permits RADIUS traffic,” but the critical missing piece is the user group that references the RADIUS server. Remember the memory tip: “Server first, then group—no group, no login.”
⚠ Common exam trap
It's easy for candidates to think a local user account is required for each RADIUS user, but RADIUS offloads authentication to an external server, making local accounts unnecessary.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A RADIUS server object with IP address and shared secret
Option B is correct because configuring RADIUS authentication on a FortiGate requires creating a RADIUS server object under User & Authentication > RADIUS Servers, which must include the server's IP address and the shared secret used to encrypt the RADIUS exchange (typically over UDP ports 1812/1813). Option D is correct because the RADIUS server object alone does not enforce authentication; you must create a user group that references the RADIUS server so it can be applied in firewall identity-based policies or SSL-VPN/LDAP-style authentication rules. Option A is not required because PKI certificates are only needed for EAP/TLS-based RADIUS or LDAPS scenarios, not basic RADIUS shared-secret authentication. Option C is not required because FSSO is a separate agent-based single sign-on mechanism, not a prerequisite for RADIUS. Option E is not required because RADIUS users are authenticated against the external RADIUS database, not against local FortiGate accounts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A PKI certificate for the RADIUS server
Why it's wrong here
RADIUS authentication requires only the server's shared secret, IP address and port; a PKI certificate is unnecessary unless RADIUS runs over RadSec (TLS). Certificates are tempting because they secure EAP-TLS or RadSec deployments, but plain RADIUS on a FortiGate does not require one.
- ✓
A RADIUS server object with IP address and shared secret
Why this is correct
RADIUS authentication requires a server object defining the RADIUS host's IP address and the shared secret used to encrypt and authenticate the FortiGate-to-server exchange. Without this object, the FortiGate cannot reach or trust the RADIUS server, so authentication requests fail.
- ✗
An FSSO connector
Why it's wrong here
FSSO polls Active Directory domain controllers for login events; it does not provide the shared secret and server details RADIUS needs. FSSO is tempting because it also authenticates users on a FortiGate, but it is the correct choice only when integrating transparent AD single sign-on rather than RADIUS.
- ✓
A user group that references the RADIUS server
Why this is correct
A user group referencing the RADIUS server binds authenticated users to a policy-relevant group, which firewall policies then match. Without this group, RADIUS-authenticated users have no group membership, so no policy grants them access despite successful server authentication.
- ✗
A local user account for each RADIUS user
Why it's wrong here
RADIUS authentication validates credentials against the external server, so per-user local accounts are unnecessary and would bypass that flow. The required items are the RADIUS server configuration and a user group referencing it. Local accounts are tempting because FortiGate supports them, but they suit local authentication, not RADIUS.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate administrator is configuring RADIUS authentication for firewall users. Which THREE steps are required to complete the configuration? (Select THREE.)
medium- A.Import the RADIUS server certificate into FortiGate
- ✓ B.Configure a firewall policy with the user group set in 'users/groups'
- ✓ C.Define the RADIUS server under 'config user radius'
- ✓ D.Create a user group that uses the RADIUS server as the authentication source
- E.Enable 'set auth-type radius' on the interface
Why B: A firewall policy must reference the user group that uses the RADIUS server as its authentication source. Without this policy configuration, RADIUS-authenticated users cannot match the policy and will be denied access. The 'users/groups' field in the firewall policy is where the user group object is specified to enforce authentication-based access control.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.