New Member

Question

2FA with RADIUS

Forum|Forum|3 years ago
October 27, 2022
10 replies
5503 views

FortiOS 6.2.5
Are there any instructions how to create email or certificate-based 2FA for RADIUS users?

FortiGate

Anthony_E

Staff

Hello potapnev,

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Regards,

Best Regards

JeremyNV

Visitor III

Hello
Any ideas?

gfleming

Staff

You've been given excellent responses already. If you aren't happy with the solution provided using FortiGate as email provider, you need to look at your RADIUS server to provide this functionality.

gfleming

Staff

This would be a function of your RADIUS server. Which RADIUS server are you using.

The FortiGate only acts as a RADIUS client...

bpozdena_FTNT

Staff

1. Email token delivery:

config user local     edit "user1"         set type radius         set two-factor email         set email-to "user1@example.com"         set radius-server "my_radius_server"     next end

You can also use your custom SMTP server.

2. Certificate based SSL VPN authentication:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Combining-remote-user-authentication-and-client/ta-p/192577
You can also just enable client certificate authentication on the SSL VPN server: https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/266506/ssl-vpn-with-certificate-authentication

JeremyNV

Visitor III

In the email token option I'll need to add every user manually? Or it will take emails from radius server for every user?

Markus_M

Staff & Editor

Hi Jeremy,

every user needs to be manually configured, if the second factor is set on the FortiGate.

If the second factor is set on another server like RADIUS, it will have to be configured there. FortiAuthenticator can import users from LDAP and automatically read the email address of that user, assign FortiToken Mobile and send the FortiToken Mobile activation to the email address that was imported. "Remote user sync rules" are the trick.

Best regards,

Markus

Sign up

Login with SSO

Login to the community

Login with SSO