Correct Method for MSP Co-Management with MFA
As an MSP, we co-manage firewalls with in-house IT. Combination of leased and customer owned appliances. We have all customers in our FortiGate Cloud MSP edition instance. Technicians are all setup with individual cloud accounts and forced MFA. In-house IT takes the included tokens.
For other systems, we have a shared MSP login with TOTP key entered into our password management system. Password management is protected by individual logins with MFA. IT Glue…. I believe this is pretty common.
The problem lies in three spots.
1. We cannot add a FortiToken to any password management system. We have to manually add/remove technicians. This is a huge security blunder waiting to happen.
2. FortiTokens expense would get unreal. We have many clients that are T&M. We don’t get paid to have access, but when we get called, we need secure access.
3. Since the appliance must be registered with the primary forticloud account, we cannot MFA it. Technicians need to be able to add appliances without waiting on the token holder to respond.
We looked at FortiManager, but it was more designed for a single company applying policies over a large deployment. Our clients are extremely different in needs. As such, it is more effective to manage directly from the appliance.
We tried doing the login via cloud; however, that only worked for the primary account.
Many years ago, there was a forum post on asking TOTP abilities. Yes, it is less secure; however, the barriers to implementation make the FortiGates less secure.
What is the best method to address the following:
- enable MFA on the master account
- provide remote access logins for technicians.