2FA-Authentication via Fortimanager and FortiAuthenticator

Question

Hello dear Community,i would like to configure 2FA-Authentication via Fortimanager and FortiAuthenticator.  We have a fortigate 200F in use.This Technical Tip was very helpful for us:Technical Tip: Radius authentication with FortiAut... - Fortinet CommunityMy first question is:The SSLVPN should be configured for 80 partners. Is there a possibility that I don't have to create manual groups 80 times so I can assign them a portal? Or do I have to create 80 groups and 80 portals with different bookmarks? Is it possible that I can only configure one portal and still assign different bookmarks to the partner?My second question:I usually create the UserGroups for the LDAP users on the Fortiauthenticator and then I configure them on the Fortigate so that they can authenticate via Radius & 2FA. Is there a possibility that I can only perform the configuration via the FortiManager, so I do not have to configure on two devices? Can I use the Fortimanager to create the ldap user groups for radius authentication and then assign them to an SSLVPN portal?Best regards!

OFP · Accepted Answer

Hello dear @Debbie_FTNT ,thank you very much for the quick response and for your support! I really appreciate it.Regarding my question 1:I mentioned that there are 80 partners, but these 80 partners have 200 users in total. If I understood it correctly, then I would have to edit 200User at CLI level, right?Regarding my question 2:Just to be sure, so I have to configure both devices. Once the Fortiauthenticator and once the Fortigate/FortiManager, right?Thank you and best regards!!

Debbie_FTNT · Answer

Hey OFP,

regarding your first question, there are user-defined bookmarks (user-specific bookmarks, even if the users are in the same group); these are NOT defined under the portal specifically, but under 'config vpn ssl web user-bookmark'

-> those entries are generated automatically when a user connects to web portal VPN for the first time, but can also be created manually

-> they follow the format 'user#group'
For example:

show vpn ssl web user-bookmark
edit "user2#SAML-FAC"
config bookmarks
edit "1"
set apptype rdp
set host "10.0.0.1"
set port 3389
next
end
next
end

-> that bookmark is for user2, and they log in via group 'SAML-FAC'.
This is not something that can be really created via GUI in FortiGate.

In FortiManager, you could create the user-specific bookmarks via Device Manager > CLI-only options, or maybe via VPN Manager, but I'm not certain about the VPN Manager. It is NOT an ADOM-level object, so not something you can configure in Policies&Objects

Regarding your second question, you can certainly create the RADIUS server entry and user group on FortiManager that should be pushed to FortiGate, but you can't push configuration from FortiManager to FortiAuthenitcator. You will have to configure FortiAuthenticator and then either FortiGate (and sync to FortiManager) or FortiManager (and install to FortiGate).

I hope that helps!

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded