Is it possible to use the FortiToken 410 for authentication beyond the FortiGate firewall?

Hi @rvanhilst 

FortiToken 410  supports FIDO U2F and FIDO2 protocols can be deployed with FortiAuthenticator ,FortiToken Cloud or Managing the device PIN, please check the guide below.

https://docs.fortinet.com/document/fortitoken/latest/fortitoken-410-deployment-guide/639061/deployment

Hi Rbraha,

I have the 410 FortiTokens in my possession but feel lost on the activation process. When I attach a token and try to add it to FortiOS, nothing registers—no command line output, and I don’t see any serial number or seed. Most forum resources focus on mobile tokens.

Because of this—and to avoid the risks (unauthorized access, MITM attacks, spoofing, DoS, etc.) outlined in the FortiOS guide—I’m holding off connecting my FortiGate online until I’ve activated my FortiTokens. I haven’t even activated my license yet and am wondering if that can also be done offline.

Any advice or workarounds for safely activating both my license and FortiTokens using an ultra-secure, offline-first method would be greatly appreciated.

Thanks in advance.

The FTK-410-5 hardware tokens are compatible with FortiGates, but only when used through FortiIdentity Cloud or FortiAuthenticator. FortiGate does not support direct registration of FIDO-based hardware tokens like the 410. You need FortiIdentity Cloud or FortiAuthenticator to manage and provision these tokens.

Per-user licensing means you only need one license per user who will use a token. If you have 1 user, you need 1 license, even if you’re buying from the 25-499 user SKU. The SKU range defines the pricing tier, not the minimum purchase quantity. We assumed a one-year contract.

FortiCloud Analytics is not required for FortiToken hardware activation, but the FortiGate must be registered under a FortiCloud account, and you need an active FortiIdentity Cloud subscription to manage the tokens.

You’ll need to:

1. Purchase FortiIdentity Cloud licenses (one per user).
2. Register the FortiGate under FortiCloud (if not already).
3. Activate the FortiIdentity Cloud subscription under the same FortiCloud account.
4. Provision the FortiToken 410s via FortiIdentity Cloud.