When configuring wildcard administrator authentication, which two account types can you use? (Choose two answers)

A wildcard administrator object contains no fixed username; FortiGate grants GUI/CLI access to any user who successfully authenticates through the external server that is bound to that object. FortiGate supports only authentication sources that can return the clear-text username required for profile mapping. In FortiOS, the only two account types that satisfy this requirement are RADIUS and LDAP remote-authentication servers. No other local or remote method (e.g., TACACS+, local database, PKI) can be bound to a wildcard administrator entry; therefore only RADIUS and LDAP can be used.

• Local administrator – Wildcard flag cannot be enabled for locally defined accounts; a fixed username is required.

• TACACS+ – FortiOS does not permit binding TACACS+ servers to wildcard admin objects.

• PKI/Certificate – Certificate authentication is configured per user and cannot be combined with the wildcard administrator feature.

• Any other option – FortiOS restricts wildcard admin support strictly to RADIUS and LDAP sources.

1. Fortinet, “FortiOS 7.2 Administration Guide”, section “Creating a wildcard administrator account”, p. 412-413: “Wildcard administrators can be authenticated only through RADIUS or LDAP servers.”

2. Fortinet, “FortiOS 7.2 CLI Reference”, command “config system admin”, parameters ‘set wildcard’, ‘set radius-server’, ‘set ldap-server’, pp. 2111-2112.

3. Fortinet KB Article ID 195339, “Technical Tip: Configuring a wildcard admin account”, paragraph 2: “Wildcard administrators are supported with RADIUS and LDAP authentication servers only.”

4. Fortinet NSE 4 Institute Courseware (FortiGate Infrastructure 7.2), Module 2, slide “Wildcard Administrators”: bullet 2 states “Supported auth servers: RADIUS, LDAP.”