Technical Tip: FortiAuthenticator FortiMobile token OTP using on multiple devices at the same time

Somashekara_Hanumant · ‎10-25-2024

Description

This article describes whether the same OTP can be used on multiple devices at the same time or not.

Scope

FortiAuthenticator.

Solution

Expectations, Requirements.

FortiAuthenticator as RADIUS server, 2 FortiGates as RADIUS client (can be any other RADIUS client).

Configuration:

User configuration on FortiAuthenticator with 2FA (FortiMobile token).

User group:

FortiAuthenticator is configured as RADIUS Server for 2 FortiGates as clients:

RADIUS policies need to make sure that the above RADIUS clients are part of the same policy.

Also, make sure to enable the 'Radius Auth' on the respective interface on Authenticator:

Configure the RADIUS on both FortiGates as below:

config user radius
edit "win_rad"
set server "10.0.20.120"
set secret ENC QuWAo4o
next
end

User Group configuration:

config user group
edit "radis_gp"
set member "win_rad"
config match
edit 1
set server-name "win_rad"
set group-name "SSLVPN_Group"
next
end
next
end

Admin user configuration:

config system admin
edit "rad_usr"
set remote-auth enable
set accprofile "super_admin"
set vdom "root"
set wildcard enable
set remote-group "radis_gp"
next
end

Repeat the similar configuration on another FortiGate.

Verification:

Try to authenticate on both FortiGates using the user 'test12', the user will get an OTP prompt and enter the OTP on the first FortiGate, the user will successfully login to the FortiGate, then immediately try to enter the OTP on the second FortiGate, and the user will not be able to log in.

Find the below logs from the authenticator for working and not working login attempts.

Working:

Conclusion:

The token generates a one-time password (OTP), which becomes invalid after use and cannot be reused. If the user attempts to use the same token code again, an error will occur because the previous OTP has already been consumed. Users need to wait for the next token and authenticate.