11. System Authentication

Separate from Services (FreeRADIUS), this page lets the gateway itself authenticate Web UI admin logins against an external RADIUS or LDAP server — useful if your organization already has a central directory. The gateway acts as a client only, never a server, in this role.

• On first successful external login, a local account is auto-created (visible under System > Users, tagged "External").
• Which local Role (Administrator / Network Operator / Auditor) that account receives is decided entirely by the Group → Role Mapping table on this page, re-evaluated on every login.
• A login with correct external credentials but no matching group mapping is rejected — matching credentials alone is not sufficient to gain access (fail-closed by design).

Note

This covers Web UI admin login only. RADIUS authentication for VPN users (Chapter 9) is configured separately, per-VPN-type.