FortiSIEM & Best Practices for 2FA/MFA

Hi ​@ghr,

For external authentication, use SAML, because of two main opportunities:

1. All the MFA-stuff is managed by the SAML Identity Provider (IdP) and you don't need to care about what the FSM can and cannot
2. The browser-only and IdP-dependency of SAML enables to draw a hard line (e.g. with firewall rules in front of your cluster) between official user and API requests. As the API (e.g. Collector/Agent → Worker) uses TCP/443 and your users use TCP/443, you cannot differentiate them, if they use the usual sign-on process

If SAML is too complex or you don't have an IdP, you'd usually use RADIUS with a RADIUS-server that manages MFA (e.g. FortiAuthenticator). Unfortunately, the FSM login-interface only provides the classic method of packing password and TOTP together in the password-field, which is kind of inconvenient on most password managers.

The documentation is very good for details on the configuration:

https://docs.fortinet.com/document/fortisiem/7.5.0/user-guide/344292/external-authentication-settings

Best,

Christian

Hi Ghr

Didn’t try with FSM before but any device that support RADIUS supports 2FA as well. And in case it doesn’t support Access-Challenge password then token) then it will work by password+token concatenation.

In case you don’t have FortiAuthenticator and are looking for a free software then FreeRADIUS may one of be the best choices (however not easy setup).