Add administrator accounts

Administrator elements represent administrator accounts in the SMC. Administrators configure and monitor the SMC and the NGFW Engines.

1. Select Configuration, then browse to Administration.
2. Right-click Access Rights and select New > Administrator.
3. From the Type drop-down list, select where the administrator account is stored.
4. If you selected Linked to LDAP, select the user and user group in the integrated external LDAP directory to which the administrator account is linked.
   1. Click Select next to the User field, then select a User element.
   2. (Optional) Click Select next to the Group field, then select the User Group to which the User element must belong for SMC access to be allowed.
5. (When Local is selected) In the Name field, enter a unique name.
   The administrator uses this user name to log on to the Management Client. For administrator accounts that are linked to user accounts in an integrated external LDAP directory, the name is filled in automatically.
6. To authenticate administrator logons using a user name and password on the Management Server, configure these options.
   1. From the Authentication drop-down list, select Local Username and Password.
   2. In the Password fields, enter and confirm the password, or click Generate Password to generate a temporary random password.
      Generated passwords are one-time passwords. The administrator is automatically prompted to enter a new password at the first logon.

      Note: If you replicate administrator accounts as local accounts on engines, you must define a separate password for the local engine accounts.
   3. (Optional, manually entered passwords) To require the administrator to enter a new password at the first logon, select Require Administrator to Change Password at First Logon.
7. To authenticate administrator logons using RADIUS or TACACS+ authentication by an external authentication server, configure these options.
   1. From the Authentication drop-down list, select RADIUS or TACACS+.
   2. From the Authentication Method drop-down list, select an Authentication Method element, or click Select to select a different Authentication Method element.
8. To authenticate administrator logons using simple password authentication against an integrated external LDAP database, select LDAP.
9. To authenticate administrator logons using certificate-based authentication, configure these options.
   1. From the Authentication drop-down list, select Client Certificate.
   2. From the Client Identity Type drop-down list, select the certificate field that is used to identify the administrator.
   3. Specify the value of the certificate field in one of the following ways:
      • In the Identity Value field, enter the value of the certificate field.
      • Click Fetch From Certificate, then import the certificate to get the value from the certificate.
10. On the Permissions tab, define the administrator permissions.
    CAUTION:

    Select only the minimum necessary permissions for each Administrator account.
11. For administrator accounts with restricted permissions, define the rights and granted elements.
    1. Click Add Role.
       A new Administrator Role appears in the list.
    2. Click the Role cell and select the administrator role that defines the rights you want to set.
    3. Right-click the Granted Elements cell for the role and select Edit Granted Elements.
    4. Select the elements to which the rights granted by the administrator role apply.
       The Set to ALL action depends on the type of elements. For example, if you browse to Firewalls and click Set to ALL, the item All Firewalls is added. You can also select one or more predefined or user-created Access Control Lists. Simple elements includes all elements except elements that have a dedicated system Access Control List. For example, there are dedicated Access Control Lists for different types of NGFW Engines and their policies.
    5. (Optional) If Domain elements have been configured, click the Domains cell to select the Domains in which the rights granted by the administrator role and the selected elements apply.
    6. (Optional) If Domain elements have been configured, leave Allow Administrators to Log On to the Shared Domain selected to allow the administrator to log on to the Shared Domain. Otherwise, the administrator is only allowed to log on to the specified Domains.
12. Click OK.