Unable to 'approve' 2FA prompt with VPN while 6-digit code works fine

Question

Hello,

We've configured our Fortigate firewall this afternoon and configured our SSL VPN together with MFA. Everything works fine, but it seems that we have a problem with our MFA. The Fortitoken application is configured and shows a MFA code.

The Approve/Deny prompt isn't always working, it only appears to work sometimes while manually entering the 6-digit MFA code works fine in the same attempt. Did anyone ever experience something like this that managed to solve this?

We've enabled FTM on our WAN interface, a valid Forti Softwaretoken license is connected to the account. It doesn't matter which account we use, ever VPN account seems to experience this problem.

Thank you in advance!

Riggie · Accepted Answer

Hello,

Thanks a lot for your reply. After reading your documentation I found this part: "There must be at least one administrator account with no trusted hosts configured:".

We had our Administrator account limited to a few trusted hosts, therefore it didn't accept the push notification OUTSIDE of those trusted hosts. We created a separate administrator for the push services and it seems to work now.

Thanks a lot for your reply!

bpozdena_FTNT · Answer

In order for the PUSH authentication to work, you need to configure it on your Fortigate and enable it on the client-facing interfaces. The client phones will also need to have reachability to the Fortigate.

More details can be found in the bellow articles:

https://docs.fortinet.com/document/fortigate/6.4.5/administration-guide/927108/fortitoken-mobile-push

https://docs.fortinet.com/document/fortigate/6.2.1/cli-reference/109620/system-ftm-push

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/927108/fortitoken-mobile-push

https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiToken-mobile-push-notification/ta-p/195578

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/183204/ssl-vpn-with-fortitoken-mobile-push-authentication