{"id":420,"date":"2026-07-19T20:47:37","date_gmt":"2026-07-19T20:47:37","guid":{"rendered":"https:\/\/techvision.id.vn\/?p=420"},"modified":"2026-07-19T20:47:38","modified_gmt":"2026-07-19T20:47:38","slug":"huong-dan-cau-hinh-chung-thuc-fortigate-voi-ldap-active-directory","status":"publish","type":"post","link":"https:\/\/techvision.id.vn\/?p=420","title":{"rendered":"H\u01b0\u1edbng d\u1eabn c\u1ea5u h\u00ecnh ch\u1ee9ng th\u1ef1c FortiGate v\u1edbi LDAP\/ Active Directory"},"content":{"rendered":"\n

Gi\u1edbi thi\u1ec7u t\u1ed5ng quan v\u1ec1 c\u1ea5u h\u00ecnh ch\u1ee9ng th\u1ef1c FortiGate v\u1edbi LDAP\/Active Directory<\/strong><\/h2>\n\n\n\n

\u0110\u1ec3 \u0111\u1ea3m b\u1ea3o t\u00ednh b\u1ea3o m\u1eadt cho qu\u00e1 tr\u00ecnh x\u00e1c th\u1ef1c ng\u01b0\u1eddi d\u00f9ng v\u00e0 nh\u00f3m th\u00f4ng qua Active Directory, ch\u00fang ta s\u1ebd tri\u1ec3n khai giao th\u1ee9c LDAPS, m\u1ed9t phi\u00ean b\u1ea3n an to\u00e0n c\u1ee7a LDAP s\u1eed d\u1ee5ng giao th\u1ee9c SSL \u0111\u1ec3 m\u00e3 h\u00f3a to\u00e0n b\u1ed9 qu\u00e1 tr\u00ecnh truy\u1ec1n d\u1eef li\u1ec7u.<\/p>\n\n\n\n

\u0110\u1ea7u ti\u00ean, ch\u00fang ta s\u1ebd t\u1ea1o m\u1ed9t ch\u1ee9ng ch\u1ec9 c\u01a1 quan c\u1ea5p ch\u1ee9ng ch\u1ec9 (CA) tr\u00ean m\u00e1y ch\u1ee7 Windows Server 2012. Ch\u1ee9ng ch\u1ec9 CA n\u00e0y s\u1ebd \u0111\u00f3ng vai tr\u00f2 nh\u01b0 m\u1ed9t c\u01a1 quan trung t\u00e2m \u0111\u1ec3 c\u1ea5p v\u00e0 qu\u1ea3n l\u00fd c\u00e1c ch\u1ee9ng ch\u1ec9 kh\u00e1c, bao g\u1ed3m c\u1ea3 ch\u1ee9ng ch\u1ec9 s\u1ebd \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 m\u00e3 h\u00f3a k\u1ebft n\u1ed1i LDAPS. Sau khi t\u1ea1o, ch\u1ee9ng ch\u1ec9 CA s\u1ebd \u0111\u01b0\u1ee3c xu\u1ea5t ra d\u01b0\u1edbi d\u1ea1ng m\u1ed9t file.<\/p>\n\n\n\n

Ti\u1ebfp theo, file ch\u1ee9ng ch\u1ec9 CA n\u00e0y s\u1ebd \u0111\u01b0\u1ee3c nh\u1eadp v\u00e0o thi\u1ebft b\u1ecb Firewall FortiGate<\/strong><\/a>. Vi\u1ec7c nh\u1eadp ch\u1ee9ng ch\u1ec9 CA v\u00e0o FortiGate c\u00f3 \u00fd ngh\u0129a r\u1ea5t quan tr\u1ecdng v\u00ec n\u00f3 cho ph\u00e9p FortiGate x\u00e1c minh t\u00ednh h\u1ee3p l\u1ec7 c\u1ee7a c\u00e1c ch\u1ee9ng ch\u1ec9 kh\u00e1c \u0111\u01b0\u1ee3c c\u1ea5p b\u1edfi CA n\u00e0y. Khi FortiGate nh\u1eadn \u0111\u01b0\u1ee3c m\u1ed9t y\u00eau c\u1ea7u k\u1ebft n\u1ed1i LDAPS, n\u00f3 s\u1ebd ki\u1ec3m tra xem ch\u1ee9ng ch\u1ec9 c\u1ee7a m\u00e1y ch\u1ee7 g\u1eedi y\u00eau c\u1ea7u c\u00f3 \u0111\u01b0\u1ee3c c\u1ea5p b\u1edfi CA m\u00e0 FortiGate \u0111\u00e3 tin t\u01b0\u1edfng hay kh\u00f4ng.<\/p>\n\n\n\n

Cu\u1ed1i c\u00f9ng, ch\u00fang ta s\u1ebd s\u1ebd c\u1ea5u h\u00ecnh FortiGate \u0111\u1ec3 s\u1eed d\u1ee5ng ch\u1ee9ng ch\u1ec9 CA v\u1eeba nh\u1eadp cho c\u00e1c k\u1ebft n\u1ed1i LDAPS. B\u1eb1ng c\u00e1ch n\u00e0y, t\u1ea5t c\u1ea3 c\u00e1c giao ti\u1ebfp gi\u1eefa FortiGate v\u00e0 m\u00e1y ch\u1ee7 Windows Server 2012 s\u1ebd \u0111\u01b0\u1ee3c m\u00e3 h\u00f3a b\u1eb1ng SSL, \u0111\u1ea3m b\u1ea3o  th\u00f4ng tin m\u1eadt kh\u1ea9u c\u1ee7a ng\u01b0\u1eddi d\u00f9ng \u0111\u01b0\u1ee3c b\u1ea3o v\u1ec7 an to\u00e0n, tr\u00e1nh b\u1ecb \u0111\u00e1nh c\u1eafp ho\u1eb7c l\u00e0m l\u1ed9.<\/p>\n\n\n\n

C\u00e1c b\u01b0\u1edbc c\u1ea5u h\u00ecnh ch\u1ee9ng th\u1ef1c FortiGate v\u1edbi Active Directory<\/strong><\/h2>\n\n\n\n

D\u1ecbch v\u1ee5 ch\u1ee9ng ch\u1ec9 Active Directory (AD CS) ph\u1ea3i \u0111\u01b0\u1ee3c c\u00e0i \u0111\u1eb7t trong Windows Server 2012 c\u1ee7a b\u1ea1n.<\/p>\n\n\n\n

\"cau-hinh-chung-thuc-fortigate-voi-ldap-active-directory-2.jpg\"\/<\/figure>\n\n\n\n

B\u01b0\u1edbc 1: Xu\u1ea5t ch\u1ee9ng ch\u1ec9 LDAPS trong Active Directory (AD)<\/strong><\/h2>\n\n\n\n

M\u1edf Command Prompt, ch\u1ecdn mmc v\u00e0 nh\u1ea5n enter. Ch\u1ecdn File r\u1ed3i nh\u1ea5n v\u00e0o Add\/Remove Snap-in. Ch\u1ecdn Certificates r\u1ed3i nh\u1ea5n v\u00e0o Add. Trong Certificates snap-in, ch\u1ecdn Computer account r\u1ed3i \u1ea5n Next.<\/p>\n\n\n\n

\"cau-hinh-chung-thuc-fortigate-voi-ldap-active-directory-3.jpg\"\/<\/figure>\n\n\n\n

Trong Select Computer, n\u1ebfu b\u1ea1n \u0111ang l\u00e0m vi\u1ec7c t\u1ea1i m\u00e1y ch\u1ee7 LDAP y\u00eau c\u1ea7u ch\u1ee9ng ch\u1ec9, h\u00e3y ch\u1ecdn Local. N\u1ebfu kh\u00f4ng, h\u00e3y ch\u1ecdn Another computer v\u00e0 nh\u1ea5n Browse \u0111\u1ec3 \u0111\u1ecbnh v\u1ecb m\u00e1y ch\u1ee7 LDAP y\u00eau c\u1ea7u ch\u1ee9ng ch\u1ec9. Sau khi ch\u1ecdn \u0111\u00fang m\u00e1y t\u00ednh, h\u00e3y ch\u1ecdn OK r\u1ed3i nh\u1ea5n Finish.<\/p>\n\n\n\n

\"cau-hinh-chung-thuc-fortigate-voi-ldap-active-directory-4.jpg\"\/<\/figure>\n\n\n\n

Trong b\u1ea3ng \u0111i\u1ec1u khi\u1ec3n, h\u00e3y m\u1edf r\u1ed9ng Ch\u1ee9ng ch\u1ec9 (<m\u00e1y t\u00ednh >). Trong b\u1ea3ng \u0111i\u1ec1u khi\u1ec3n ch\u1ee9ng ch\u1ec9 c\u1ee7a m\u00e1y t\u00ednh c\u00f3 ch\u1ee9a ch\u1ee9ng ch\u1ec9 c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng \u0111\u1ec3 K\u00fd ch\u1ee9ng ch\u1ec9, h\u00e3y nh\u1ea5n chu\u1ed9t ph\u1ea3i v\u00e0o ch\u1ee9ng ch\u1ec9 CA, nh\u1ea5n v\u00e0o All Tasks, r\u1ed3i nh\u1ea5n ch\u1ecdn Export.<\/p>\n\n\n\n

\"cau-hinh-chung-thuc-fortigate-voi-ldap-active-directory-5.jpg\"\/<\/figure>\n\n\n\n

Tr\u00ean m\u00e0n h\u00ecnh ch\u00e0o m\u1eebng c\u1ee7a Certificate Export Wizard, h\u00e3y nh\u1ea5n v\u00e0o Next. Sau \u0111\u00f3, tr\u00ean m\u00e0n h\u00ecnh Export Private Key, h\u00e3y ch\u1ecdn No, sau \u0111\u00f3 nh\u1ea5n Next.<\/p>\n\n\n\n

\"cau-hinh-chung-thuc-fortigate-voi-ldap-active-directory-6.jpg\"\/<\/figure>\n\n\n\n

Tr\u00ean m\u00e0n h\u00ecnh Cerificate Export Wizard, ch\u1ecdn DER.<\/p>\n\n\n\n

\"cau-hinh-chung-thuc-fortigate-voi-ldap-active-directory-7.jpg\"\/<\/figure>\n\n\n\n

Tr\u00ean m\u00e0n h\u00ecnh File to Export, nh\u1ea5n \u0111\u01b0\u1eddng d\u1eabn, t\u00ean t\u1ec7p v\u00e0 ph\u1ea7n m\u1edf r\u1ed9ng t\u1ec7p .cer v\u00e0o h\u1ed9p File name r\u1ed3i Next. X\u00e1c nh\u1eadn c\u00e0i \u0111\u1eb7t tr\u00ean m\u00e0n h\u00ecnh ho\u00e0n t\u1ea5t r\u1ed3i nh\u1ea5n v\u00e0o Finish. B\u1ea1n s\u1ebd th\u1ea5y th\u00f4ng b\u00e1o b\u1eadt l\u00ean cho bi\u1ebft qu\u00e1 tr\u00ecnh xu\u1ea5t \u0111\u00e3 th\u00e0nh c\u00f4ng, ch\u1ecdn OK.<\/p>\n\n\n\n

\"cau-hinh-chung-thuc-fortigate-voi-ldap-active-directory-8.jpg\"\/<\/figure>\n\n\n\n

B\u01b0\u1edbc 2: Nh\u1eadp ch\u1ee9ng ch\u1ec9 LDAPS v\u00e0o FortiGate<\/strong><\/h2>\n\n\n\n

V\u00e0o System > Config > Features v\u00e0 ch\u1ecdn Certificates.<\/p>\n\n\n\n

\"cau-hinh-chung-thuc-fortigate-voi-ldap-active-directory-9.jpg\"\/<\/figure>\n\n\n\n

V\u00e0o System > Certificates v\u00e0 ch\u1ecdn Import > CA Certificate. Ch\u1ecdn Local PC v\u00e0 Choose File , sau \u0111\u00f3 duy\u1ec7t \u0111\u1ebfn file ch\u1ee9ng ch\u1ec9 v\u00e0 nh\u1ea5n v\u00e0o OK.<\/p>\n\n\n\n

\"cau-hinh-chung-thuc-fortigate-voi-ldap-active-directory-10.jpg\"\/<\/figure>\n\n\n\n

B\u1ea1n c\u00f3 th\u1ec3 \u0111\u1ed5i t\u00ean CA_Cert_1 do h\u1ec7 th\u1ed1ng t\u1ea1o ra \u0111\u1ec3 m\u00f4 t\u1ea3 r\u00f5 r\u00e0ng h\u01a1n.<\/p>\n\n\n\n

V\u00ed d\u1ee5 v\u1ec1 CLI:<\/p>\n\n\n\n

FGT # config vpn certificate ca<\/p>\n\n\n\n

FGT (ca) # rename CA_Cert_1 to LDAPS-CA<\/p>\n\n\n\n

FGT (ca) # end<\/p>\n\n\n\n

T\u00ean trong Ch\u1ee9ng ch\u1ec9 CA b\u00ean ngo\u00e0i hi\u1ec7n hi\u1ec3n th\u1ecb l\u00e0 LDAPS-CA.<\/p>\n\n\n\n

\"cau-hinh-chung-thuc-fortigate-voi-ldap-active-directory-11.jpg\"\/<\/figure>\n\n\n\n

B\u01b0\u1edbc 3: T\u1ea1o \u0111\u1ed1i t\u01b0\u1ee3ng LDAPS Server trong FortiGate<\/strong><\/h2>\n\n\n\n

User DN ph\u1ea3i c\u00f3 quy\u1ec1n truy c\u1eadp m\u00e1y ch\u1ee7.<\/p>\n\n\n\n

\"cau-hinh-chung-thuc-fortigate-voi-ldap-active-directory-12.jpg\"\/<\/figure>\n\n\n\n

B\u01b0\u1edbc 4: K\u1ebft qu\u1ea3<\/strong><\/h2>\n\n\n\n

X\u00e1c minh \u0111\u1ed1i t\u01b0\u1ee3ng M\u00e1y ch\u1ee7 LDAPS \u0111ang x\u00e1c th\u1ef1c \u0111\u00fang. Tr\u00ean FortiGate, h\u00e3y s\u1eed d\u1ee5ng l\u1ec7nh diagnostic sau \u0111\u1ec3 ki\u1ec3m tra x\u00e1c th\u1ef1c v\u1edbi m\u00e1y ch\u1ee7 LDAPS. Khi b\u1ea1n nh\u1eadp l\u1ec7nh, h\u00e3y s\u1eed d\u1ee5ng t\u00ean ng\u01b0\u1eddi d\u00f9ng v\u00e0 m\u1eadt kh\u1ea9u th\u1ef1c t\u1ebf tr\u00ean m\u00e1y ch\u1ee7 LDAPS (v\u00ed d\u1ee5 administrator v\u00e0 pa$$w0rd). N\u1ebfu m\u1ecdi th\u1ee9 \u0111\u01b0\u1ee3c c\u1ea5u h\u00ecnh \u0111\u00fang, \u0111\u1ea7u ra l\u1ec7nh s\u1ebd hi\u1ec7n x\u00e1c th\u1ef1c \u0111\u00e3 th\u00e0nh c\u00f4ng \u0111\u1ed3ng th\u1eddi li\u1ec7t k\u00ea c\u00e1c User Group..<\/p>\n\n\n\n

FGT # diagnose test authserver ldap LDAPS administrator pa$$w0rd<\/p>\n\n\n\n

authenticate ‘administrator’ against ‘LDAPS’ succeeded<\/strong>!<\/strong><\/p>\n\n\n\n

Group membership(s) – CN=Domain Admins,CN=Users,DC=fortinet,DC=local<\/p>\n\n\n\n

                      CN=Administrators,CN=Builtin,DC=fortinet,DC=local<\/p>\n\n\n\n

                      CN=Domain Users,CN=Users,DC=fortinet,DC=local<\/p>\n\n\n\n

T\u1ed5ng k\u1ebft<\/strong><\/h2>\n\n\n\n

Nh\u01b0 v\u1eady, ch\u00fang ta \u0111\u00e3 c\u00f9ng nhau th\u1ef1c hi\u1ec7n c\u00e1c b\u01b0\u1edbc c\u1ea5u h\u00ecnh ch\u1ee9ng th\u1ef1c FortiGate v\u1edbi LDAP\/Active Directory<\/strong><\/a>. Sau khi \u0111\u00e3 c\u1ea5u h\u00ecnh th\u00e0nh c\u00f4ng, b\u1ea1n c\u00f3 th\u1ec3 ti\u1ebfn h\u00e0nh t\u00f9y ch\u1ec9nh c\u00e1c ch\u00ednh s\u00e1ch truy c\u1eadp d\u1ef1a tr\u00ean nh\u00f3m ng\u01b0\u1eddi d\u00f9ng, \u1ee9ng d\u1ee5ng c\u00e1c t\u00ednh n\u0103ng n\u00e2ng cao c\u1ee7a FortiGate nh\u01b0 Single Sign-On (SSO) \u0111\u1ec3 n\u00e2ng cao tr\u1ea3i nghi\u1ec7m ng\u01b0\u1eddi d\u00f9ng. Vi\u1ec7t Tu\u1ea5n<\/strong><\/a> hi v\u1ecdng b\u1ea1n \u0111\u1ecdc c\u00f3 th\u1ec3 th\u1ef1c hi\u1ec7n th\u00e0nh c\u00f4ng. <\/p>\n","protected":false},"excerpt":{"rendered":"

Gi\u1edbi thi\u1ec7u t\u1ed5ng quan v\u1ec1 c\u1ea5u h\u00ecnh ch\u1ee9ng th\u1ef1c FortiGate v\u1edbi LDAP\/Active Directory \u0110\u1ec3 \u0111\u1ea3m b\u1ea3o t\u00ednh b\u1ea3o m\u1eadt cho qu\u00e1 tr\u00ecnh x\u00e1c th\u1ef1c ng\u01b0\u1eddi d\u00f9ng v\u00e0 nh\u00f3m th\u00f4ng qua Active Directory, ch\u00fang ta s\u1ebd tri\u1ec3n khai giao th\u1ee9c LDAPS, m\u1ed9t phi\u00ean b\u1ea3n an to\u00e0n c\u1ee7a LDAP s\u1eed d\u1ee5ng giao th\u1ee9c SSL \u0111\u1ec3 m\u00e3 h\u00f3a […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-420","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/techvision.id.vn\/index.php?rest_route=\/wp\/v2\/posts\/420","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/techvision.id.vn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/techvision.id.vn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/techvision.id.vn\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/techvision.id.vn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=420"}],"version-history":[{"count":1,"href":"https:\/\/techvision.id.vn\/index.php?rest_route=\/wp\/v2\/posts\/420\/revisions"}],"predecessor-version":[{"id":421,"href":"https:\/\/techvision.id.vn\/index.php?rest_route=\/wp\/v2\/posts\/420\/revisions\/421"}],"wp:attachment":[{"href":"https:\/\/techvision.id.vn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=420"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/techvision.id.vn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=420"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/techvision.id.vn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=420"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}