“With this method, you must create a user group and add the preconfigured remote server to the group. This setup allows you to select one or more pre-existing groups from the Radius server, enabling any user within those groups to be authenticated.”
“The response from the server reports success, failure, and group membership details.”
“Note that Fortinet has a vendor-specific attributes (VSA) dictionary to identify the Fortinet-proprietary RADIUS attributes. This capability allows you to extend the basic functionality of RADIUS.”
Technical Deep Dive:
The attribute shown in the exhibit is Fortinet-Group-Name = Training. This is a Fortinet RADIUS Vendor-Specific Attribute (VSA) used to return group membership information to FortiGate. FortiGate uses that returned value to match the authenticated user to the corresponding FortiGate user group, in this case Training.
That is why A is correct: the administrator needs this so FortiGate can authenticate users and place or match them into the Training group for identity-based policy control.
Why the others are wrong:
* B is wrong because the RADIUS secret is configured separately as the shared secret between FortiGate and the RADIUS server, not as a Fortinet-Group-Name attribute.
* C is wrong because OU matching is an LDAP concept, not standard RADIUS group matching.
* D is wrong because this attribute is not for “any” group; it is explicitly returning the specific group name Training.
In practice, this lets FortiGate apply firewall policies such as:
```bash
config user group
edit " Training "
set member " RADIUS_Server "
next
end
```
Then the RADIUS server returns Fortinet-Group-Name=Training, and FortiGate matches the user into that group for policy enforcement.
