FCP-FGT-AD - Firewall policies and authentication - Section 2.3

Configure different methods of firewall authentication including local, RADIUS, and LDAP user databases.

Configure firewall authentication against local user databases, RADIUS servers, and LDAP directories to require identity verification before granting policy access. Compare active authentication methods such as the captive portal with the use cases that favour each approach.

firewall authenticationRADIUSLDAPcaptive portalactive authentication

Practice question for this objective

Free sampleFirewall policies and authenticationmedium

A guest network is served by a single firewall policy from the guest interface to the internet, and the administrator wants unauthenticated guests to be redirected to a captive portal that prompts for credentials the moment they open their browser, before any traffic is allowed out. Which three conditions must be in place for the FortiGate to deliver an active-authentication captive portal prompt on this policy? Select THREE.

  • AThe firewall policy action is set to accept and a user group is assigned to the policy, so the FortiGate knows which sessions require an authenticated identity. Correct
  • BThe matching traffic uses a protocol the FortiGate can intercept and redirect for the prompt, such as HTTP or HTTPS that the captive portal can hijack. Correct
  • CCaptive portal is enabled as the authentication method, either on the source interface or on the policy, so unauthenticated sessions are redirected to the portal page. Correct
  • DFSSO must be deployed against an Active Directory domain so the FortiGate can learn each guest identity passively from domain logon events.
  • EThe policy action must be set to deny so that unauthenticated guest traffic is blocked first and only then offered the portal page.
An active-authentication captive portal needs an accept policy with a user group, a browser protocol the FortiGate can intercept, and the captive portal enabled on the interface or policy. Active authentication works by intercepting a browser session and redirecting it to a portal, so three things must align: an accept policy carrying a user or group marks which sessions need an identity, the first traffic must be HTTP or HTTPS so the FortiGate can hijack and redirect it, and captive portal must be enabled on the interface or policy so a portal page exists to serve. FSSO is passive and unrelated, and a deny policy cannot authenticate because it blocks rather than challenges.

Why A is correct: Correct: active authentication is driven by an accept policy that carries a user or group, which is what tells the FortiGate to challenge matching sessions rather than pass them anonymously.

Why B is correct: Correct: active authentication relies on intercepting a browser-based protocol to present the portal, so the first traffic the FortiGate can challenge must be HTTP or HTTPS.

Why C is correct: Correct: the portal must be explicitly enabled for that traffic, on the interface or the policy, or the FortiGate has nowhere to redirect unauthenticated guests and simply drops them.

Why D is wrong: This confuses passive single sign-on with active authentication; FSSO learns identities silently from AD logons and is the opposite of prompting guests, who have no domain account at all.

Why E is wrong: A deny policy blocks traffic outright and cannot host authentication; active authentication requires an accept policy, so setting deny would simply drop the guests with no portal shown.

See more FCP-FGT-AD practice questions, answers explained.

More in this domain

Back to all Firewall policies and authentication objectives, or the FCP-FGT-AD cert hub.

Examworthy is not affiliated with or endorsed by Fortinet. Original, blueprint-aligned practice material only.