Skip to main content
machine2389
machine2389
New Member
October 9, 2024
Question

Ubikey With Fortigate - SSL VPN

  • October 9, 2024
  • 2 replies
  • 6002 views

Hi All , 

 

We trying to figure out if we can use ubikeys with FortiGate SSL VPN for 2FA without the Forti authenticator?

Ubikeys supports fido ,ooauth .. 

 

Now we do need Forti authenticator can we use the cloud version ?

 

thank you :) 

 

 

2 replies

ndumaj
Staff
ndumaj
Staff
October 9, 2024

Hello @machine2389 
We trying to figure out if we can use ubikeys with FortiGate SSL VPN for 2FA without the Forti authenticator?  ---> Is this a Question?

Now we do need Forti authenticator can we use the cloud version ? ---> Are you interested on Public or  Privat cloud environment?

BR

    machine2389
    machine2389Author
    New Member
    October 9, 2024

    Hey Thank you for the reply - I have just got confirmation from FortiGate that only the FortiAuth VM supports it

    pminarik
    Staff
    pminarik
    Staff
    October 9, 2024

    Hi, FortiGate itself does not support FIDO2, or any other third party 2FA (FGT directly supports only FortiToken, email, SMS).


    For FIDO2, the best match is SAML, already supported by FortiGate. The 2FA will be done and managed on the IdP-side, the FortiGate has no awareness of what happens there. FortiAuthenticator can be used as SAML IdP. Or any other standard SAML implementation.

     

    Another option on Yubikeys is HOTP (like FortiToken, but hash-counter-based, not time-based). This is supported by FortiAuthenticator (=> RADIUS, SAML), or potentially other third party RADIUS/SAML service providers. (configuration guide) 

     

    Lastly, if you consider client-certificates as a valid "second factor", you can store those on Yubikeys as well and use them for authentication to SSL-VPN (or IPsec).

      machine2389
      machine2389Author
      New Member
      October 9, 2024

      Great thanks :) 

       

      We will use the FortiAuthenticator to import the ubikeys using HOTP. Do you know if we can use Forti Authenticator Could for the import or stick with the VM ?

      pminarik
      Staff
      pminarik
      Staff
      October 9, 2024

      If you mean FortiTrust Identy, which uses a Fortinet-managed cloud instance of FAC - I am not 100% sure. The option needs to be enabled in a special debug /url/path, not sure if it is available there.

      With that said, I see it mentioned in fixed issues (https://docs.fortinet.com/document/fortitrust-id/latest/fortitrust-identity-23-2-a-release-notes/737891/resolved-issues - "Using Yubikey as OTP second factor increases drift/counter unexpectedly"), which suggests compatibility.

       

      Otherwise FAC Cloud is just a regular self-managed FAC VM running in public cloud, so Yubikeys will work with it.

        Terms & ConditionsAccessibility statement