Secondary and tertiary RADIUS, LDAP, and TACAS+ servers
You can now add secondary and tertiary servers to RADIUS, LDAP, and TACAS+ remote authentication server configurations. When you add a secondary server, the FortiGate unit will contact the secondary server only if the primary server is unreachable. The FortiGate unit will only contact the tertiary server if the both the primary and secondary servers are unreachable.
Enter the following command to add up to three servers to a RADIUS server configuration. Specify a domain name or IP address for each server as well as the server secret. In the following example, the RADIUS servers are at IP addresses 172.20.120.10, 172.20.120.20, and 172.20.120.30:
config user radius
edit new-radius-server
set server 172.20.120.10
set secret 1st-secret
set secondary-server 172.20.120.20
set secondary-secret 2nd-secret
set tertiary-server 172.20.120.30
set tertiary-secret 3rd-secret
end
Enter the following command to add up to three servers to an LDAP server configuration. Specify a domain name or IP address for each server. Other than the domain name or password, the secondary and tertiary servers must use the same port and LDAP settings such as the cnid and username. In the following example, the LDAP servers are at IP addresses 192.168.10.10, 192.168.10.20, and 192.168.10.30:
config user ldap
edit "test-ldap"
set server "192.168.10.10"
set cnid "exAccountName"
set dn "dc=americas,dc=example,dc=net"
set port 3268
set type regular
set username "CN=example,OU=Service Accounts,OU=Admins,DC=example,DC=csplc,DC=net"
set password ENC AAAEAOZh5R5/oqYeUVkO2OOKh9QV6DAVZoAjbv0sonh
set member-attr "ASCCGKraftFortinetVPNInternalUsers"
set secondary-server "192.168.10.20"
set tertiary-server "192.168.10.30"
end
Enter the following command to add up to three servers to an TACAS+ server configuration. Specify a domain name or IP address and key for each server. In the following example, the TACAS+ servers are at IP addresses 10.10.10.10, 10.10.10.20, and 10.10.10.30:
config user tacacs+
edit "test-tacacs"
set server "10.10.10.10"
set key ENC 2OG/F6wocz2/CpE3eHIJs/Qt8gZsXgeNkQCuTxPWPeBk6BXDu8luM
set secondary-server "10.10.10.20"
set secondary-key ENC 2OG/F6wocz2/CpE3eHIJs/Qt8gZ
set tertiary-server "10.10.10.30"
set tertiary-key ENC 2OG/F6wocz2/CpE3eHIJs/Qt8gZ
next
end