Troubleshooting Tip: Admin user lost FortiToken / Token is not working
Description
This article describes what to do if the admin user loses a FortiToken or if the Token is not working.
Scope
FortiGate.
Solution
If FortiGate is registered to FortiGate Cloud and has 'FortiGate Cloud Subscription', refer to Technical Tip: Recover access to FortiGate via FortiCloud.
If FortiManager manages the FortiGate, remove the FortiToken assigned to the super admin from FortiManager, allowing access to the FortiGate without a token request.
On the FortiManager:
Go to Policy & Objects -> User Definition, edit the user and uncheck/disable the FortiToken. Install a policy package on the FortiGate using the steps: Install a policy package.
Otherwise, the remaining option is to Flash Format the device and upload a previously existing backup file.
The configuration backup must be performed using an administrator account with full read and write privileges. Alternatively, an administrator account assigned to the super_admin access profile may be used.
Do not use a restricted administrator profile such as read-only or limited-access profiles.
See related documentation at the bottom of this article for instructions on how to format the boot device and reload the firmware image.
After reloading the image, before uploading the latest config file, remove the 'Two-factor' lines/config from the backup as shown below:
Â
Open the config file and search for a particular 'Admin' using the name:
Â
It will look like this:
Â
config system admin
  edit "Test"
     set accprofile "super_admin"
     set vdom "root"
     set two-factor fortitoken
     set fortitoken "FTKxxxxxxxxxx"
    set email-to "adminxzx@fortixie1233.com"
     set password ENC <*****encrypted password******>
   next
endÂ
The admin name is the name that is usually entered while logging in to FortiGate in the 'Username' field. 'Test' is shown in the example just for the representation, edit the name according to the settings.
Modify the configuration above by removing the lines associated with two-factor authentication and Fortitoken. This will disable the two-factor token requirement when the administrator user 'Test' logins.
If the password is unknown/changed, especially when uploading an old backup file, delete the 'set password ENC' line as well to prompt the administrator user 'Test' to enter a new password when logging in.
Â
config system admin
  edit "Test"
     set accprofile "super_admin"
     set vdom "root"
     set password ENC <*****encrypted password******>
   next
end
Note:
When uploading the old backup config file always make sure that current FortiOS matches the firmware mentioned in the backup file. If not, perform a downgrade or upgrade to align with backup file and then perform the config file upload.
Â
Related documents:
