Technical Tip: How to assign FortiToken Mobile to users on FortiGate and FortiAuthenticator

If there is an activation code, then on GUI, create a new Hard Token or Mobile Token:

2. Locate the 20-digit code on the redemption certificate for the license: EFTMXXXXXXXX.

• Go to User & Device -> FortiTokens and select 'Create New'.
• Select 'Mobile Token’ and enter the 20-digit certificate code in the Activation Code box.
• Select 'OK'.

The same steps can be followed on FortiAuthenticator 'Importing Trial Tokens' or adding a license file for FortiToken Mobile or Hardware token.

3. Go to Authentication -> User Management -> FortiTokens -> Create New, select FortiToken Mobile, enable Get FortiToken Mobile free trial tokens or use the Activation code  0000-0000-0000-0000-0000.

Importing trial tokens in FortiAuthenticator

In order to import trial tokens on FortiAuthenticator it is necessary to have internet reachability to connect with FortiGuard servers.

From CLI on FortiGate:

   execute fortitoken-mobile import 0000-0000-0000-0000-0000
 

• Assign and provision tokens to each user who needs to use two-factor authentication.
• Verify that FortiGate has a messaging service enabled. For FortiToken it is required to have at least one SMTP or SMS server gateway.
• Go to System -> Settings.
• Configure an SMTP server.

From CLI:

config system email-server

    set server "notification.fortinet.net"

    set port 465

    set security smtps

end

Enable authentication if it is required by the server to send email messages.

If a security mode is selected, make sure the TLS tunnel can come up by importing the custom mail server's CA to the FortiGate's CA store.

Configure an SMS server for sending SMS messages to support user authentication.

config system sms-server

    edit <name>

        set mail-server {string}

    next

end

4. Add a user using the wizard, or edit an existing one.

• If a new one is added, the email address associated with this user or a phone number, if an SMS server is configured, needs to be added.
• The 'Two-factor Authentication' checkbox must be enabled.
• Select the FortiToken mobile serial to assign to the user.
• If editing the FortiToken of an existing user, use the 'Send Activation Code' button next to the token field.

5. If the SMTP or SMS server is configured correctly, the user will receive an activation code made of 16 alphanumeric digits.
   
   
6. On the end-user side (Mobile):
   1. Open the FortiToken Mobile app on the smartphone.
   2. Select + to add a new token, and the following screen will appear to either 'Scan Barcode' or 'Enter Manually' (Both items of information are part of the activation email sent to the user).