How to assign multiple mobile fortitoken to Radius users(20K users)in fortiauthenticator

Hi dabens,

it depends on where are your users coming from.

Easier way would be LDAP sync, if you do have those users in AD or in another LDAP structure, then:

FortiAuthenticator (FAC hereinafter) > GUI: Authentication > User Management > Remote User Sync Rules > {Edit/Create RULE} > Synchronization Attributes > Token-based authentication sync priorities: ...

.. and here choose what tokens you would like to assign to those who will fit an LDAP filter and so get automatically synced from your AD/LDAP to your FAC.

Note that:

- HW tokens need to be active/available on unit, and also you can specify SN of the assigned token in LDAP string attribute of your choice (name of attribute have to be in "FTK-200 serial number:" bellow), and then this specific token will be always (if available) assigned to the synced user. Another option is to have all the HW tokens in pool and just assign random one. But it is IMHO more convenient to set specif attribute in AD to the SN of the token you just handed over to user, and throught the mentioned setup be sure that this token will be assigned to user in FAC. All driven from AD, no need to touch FAC, except the initial setup of sync rule.

- for Mobile tokens FAc has to have valid license for those and so be able to assign those. Tokens are assigned from pool and as tokens are not handed over but activated on mobile device via received code, then their SNs do not need to be known in advance. Keep in mind that appropriate activation code delivery method has to be available/set (SMS/Email GW) and that users have to have proper email/mobile number set and synced (usual caveat)!

- similar for Cloud tokens, where your FAC has to be registered under same FortiCare account which do have FortiToken Cloud license and points available

- token will be assigned only if there is token of specified type (and SN if set for HW ones) available in pool

- if user is deleted, manually or due to the fact he is no more matching LDAP filter, then token assigned to him will be released back to pool of free/available tokens

Unfortunately you were not that specific about your tokens (and Fortinet produce at least 5 different models compatible with FAC) and source of your users. But I guess that 20k users are not on paper, but in some manageable structure like AD, right?

Hope this helped a bit.