Explorer II

Solved

2FA without fortiauthenticator nor fortimanager nor fortianalyzer

4 replies
1899 views

Hello team!

I have a new question about FortiClient EMS.

I need to authenticate FortiClient users with an active directory domain and with 2FA

So far, I could add the active directory domain in my FortiCllient EMS, and I can use the domain users when I connect a FortiClient (Without 2FA)

When I started to search into this, the first option I found, needed to have FortiAuthenticator, but we dont have FortiAuthenticator.

The second option that I found, is using Fortigate with the security fabric option, but my fortigate is not in a security fabric, because we havent any FortiManager or FortiAnalyzer

I did not found any other method.

Is there a way to add 2FA to AD domain users just using FortiClient EMS and Fortigate?

Thanks in advance.

Regards,

Damián

FortiClient EMS

atakannatakAnswer

Explorer

Hi @damianhlozano ,

Yes, you can use the FortiGate itself as the token server. FortiOS ships with:

Two free FortiToken Mobile (FTM) licences per unit.
Native support for extra tokens or FortiToken Cloud (subscription).

FortiClient EMS does not supply 2FA by itself; it simply passes whatever factor(s) the FortiGate asks for (LDAP-password-only or LDAP + token). So the job is done entirely on the firewall by following:

Create an LDAP server entry on FortiGate (bind DN + LDAP(S)).
Register the free FortiToken Mobile tokens (User & Authentication ▸ FortiTokens).
Assign a token to each AD user (Users ▸ Edit ▸ Two-factor = FortiToken).
Put those users into a group and use that group in your SSL-VPN/IPsec or policy.

At login FortiGate now asks for AD password + 6-digit code. If you need more tokens, buy extra FortiToken Mobile licences or enable FortiToken Cloud—still no FortiAuthenticator, FortiManager, or FortiAnalyzer required.

BR.

If my answer provided a solution for you, please mark the reply as solved it so that others can get it easily while searching for similar scenarios.

CCIE #68781

atakannatakAnswer

Explorer

Hi @damianhlozano ,

Yes, you can use the FortiGate itself as the token server. FortiOS ships with:

Two free FortiToken Mobile (FTM) licences per unit.
Native support for extra tokens or FortiToken Cloud (subscription).

FortiClient EMS does not supply 2FA by itself; it simply passes whatever factor(s) the FortiGate asks for (LDAP-password-only or LDAP + token). So the job is done entirely on the firewall by following:

Create an LDAP server entry on FortiGate (bind DN + LDAP(S)).
Register the free FortiToken Mobile tokens (User & Authentication ▸ FortiTokens).
Assign a token to each AD user (Users ▸ Edit ▸ Two-factor = FortiToken).
Put those users into a group and use that group in your SSL-VPN/IPsec or policy.

At login FortiGate now asks for AD password + 6-digit code. If you need more tokens, buy extra FortiToken Mobile licences or enable FortiToken Cloud—still no FortiAuthenticator, FortiManager, or FortiAnalyzer required.

BR.

If my answer provided a solution for you, please mark the reply as solved it so that others can get it easily while searching for similar scenarios.

CCIE #68781

damianhlozanoAuthor

Explorer II

Thank you Atakan Atak for your answer!!

Now I have 2 new questions:

1) We have many users, if we need to duplicate AD users into Fortigate, when a new user is added or deleted, I need to do the same in the Fortigate. Is there a way to accomplish this without duplicate the users?

2) I can ask to buy FortiToken licences, but I dont know if this will be approved. Is there a way to use another 2FA method? For example: email

Thanks in advance.

Regards,

Damián

atakannatak

Explorer

Hi @damianhlozano ,

Avoid duplicating AD users on the FortiGate: Create one LDAP entry and a wildcard user-group; any account that passes the bind is automatically a member, so when HR adds or deletes users in Active Directory you do nothing on the FortiGate.

https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/747268/configuring-wildcard-admin-accounts

Two-factor options without FortiToken: FortiGate can off-load the second factor to any 3rd-party service that speaks RADIUS challenge/response or SAML—the service (Duo, Azure AD MFA, Okta, OneLogin, etc.) sends the SMS / push / email ; FortiGate just relays the prompt.

BR.

If my answer provided a solution for you, please mark the reply as solved it so that others can get it easily while searching for similar scenarios.

CCIE #68781

Sign up

Login with SSO

Login to the community

Login with SSO