FortiToken Mobile (FTM) push notifications provide a convenient MFA experience, but many organizations want additional controls to ensure push authentication is only available from trusted network locations.

A simple way to reduce the attack surface is to route FortiToken Mobile push traffic through a dedicated loopback interface and then control access using firewall policies. This allows administrators to limit where FTM push requests can originate, such as corporate Wi-Fi, internal LAN segments, or approved VPN networks.

Step 1: Create a Loopback Interface

Create a loopback interface that will be used exclusively for FortiToken Mobile communication.

config system interface
    edit "FTM-Loopback"
        set type loopback
        set ip 10.255.255.1/32
    next
end

Step 2: Configure the FTM Push Server

Configure the FortiToken Mobile push service to use the loopback address.

config system ftm-push
    set server-ip 10.255.255.1
end

This forces FTM push traffic through a dedicated interface that can be controlled independently from other services.

Step 3: Create a Firewall Policy

Create a policy that allows access to the loopback interface only from approved networks, such as corporate Wi-Fi, trusted LAN segments, or VPN interfaces.

config firewall policy
    edit 0
        set name "Allow-FTM-Trusted-Networks"
        set srcintf "WiFi"
        set dstintf "FTM-Loopback"
        set action accept
        set schedule "always"
        set service "ALL"
    next
end

Consider further restricting source addresses to specific VLANs, subnets, user groups, or VPN address pools.

Benefits

• Reduces the attack surface by limiting where FortiToken Mobile push traffic can originate.

• Restricts push authentication to trusted internal and VPN-connected users.

• Prevents push authentication requests from untrusted or unauthorized networks.

• Provides greater visibility and control over FortiToken Mobile traffic flows.

• Adds an extra layer of protection against MFA abuse while maintaining the convenience of push-based authentication.

This is a lightweight configuration change that can significantly strengthen the security posture of FortiToken Mobile deployments while still supporting users connecting from approved on-site and VPN networks.