Creating administrators for Virtual Domains
Using the admin administrator account, you can create additional administrator accounts and assign them to VDOMs.
| The newly-created administrator can access the FortiGate unit only through network interfaces that belong to their assigned VDOM or through the console interface. The network interface must be configured to allow management access, such as HTTPS and SSH. Without these in place, the new administrator will not be able to access the FortiGate unit and will have to contact the super_admin administrator for access. |
The following procedure creates a new Local administrator account called admin_sales with a password of fortinet in the sales VDOM using the admin_prof default profile.
To create an administrator for a VDOM - web-based manager
1. Log in with a super_admin account.
2. Go to System > Admin > Administrators.
3. Select Create New.
4. Select Regular for Type, as you are creating a Local administrator account.
5. Enter the necessary information about the administrator: email, password, etc.
6. If this admin will be accessing the VDOM from a particular IP address or subnet, enable
Restrict this Admin Login from Trusted Hosts Only and enter the IP in
Trusted Host #1. See
“Using trusted hosts”.
7. Select prof_admin for the Admin Profile.
8. Select sales from the list of Virtual Domains.
9. Select OK.
To create administrators for VDOMs - CLI
config global
config system admin
edit <new_admin_name>
set vdom <vdom_for_this_account>
set password <pwd>
set accprofile <an_admin_profile>
...
end
Using trusted hosts
Setting trusted hosts for all of your administrators increases the security of your network by further restricting administrative access. In addition to knowing the password, an administrator must connect only through the subnet or subnets you specify. You can even restrict an administrator to a single IP address if you define only one trusted host IP address with a netmask of 255.255.255.255.
When you set trusted hosts for all administrators, the FortiGate unit does not respond to administrative access attempts from any other hosts. This provides the highest security. If you leave even one administrator unrestricted, the unit accepts administrative access attempts on any interface that has administrative access enabled, potentially exposing the unit to attempts to gain unauthorized access.
The trusted hosts you define apply both to the web-based manager and to the CLI when accessed through Telnet or SSH. CLI access through the console is not affected.
The trusted host addresses all default to 0.0.0.0/0.0.0.0 for IPv4, or ::/0 for IPv6. If you set one of the zero addresses to a non-zero address, the other zero addresses will be ignored. The only way to use a wildcard entry is to leave the trusted hosts at 0.0.0.0/0.0.0.0 or ::0. However, this configuration is less secure.
See also