Technical Tip: FortiAuthenticator FortiMobile token OTP using on multiple devices at the same time

Somashekara_Hanumant · ‎10-25-2024

Description

This article describes whether the same OTP can be used on multiple devices at the same time or not.

Scope

FortiAuthenticator.

Solution

Expectations, Requirements.

FortiAuthenticator as RADIUS server, 2 FortiGates as RADIUS client (can be any other RADIUS client).

Configuration:

User configuration on FortiAuthenticator with 2FA (FortiMobile Token).

User group:

FortiAuthenticator is configured as RADIUS Server for 2 FortiGates as clients:

RADIUS policies need to make sure that the above RADIUS clients are part of the same policy.

Make sure to enable the 'Radius Auth' on the respective interface on Authenticator:

Configure the RADIUS on both FortiGates as below:

config user radius
edit "win_rad"
set server "10.0.20.120"
set secret ENC QuWAo4o
next
end

User Group configuration:

config user group
edit "radis_gp"
set member "win_rad"
config match
edit 1
set server-name "win_rad"
set group-name "SSLVPN_Group"
next
end
next
end

Admin user configuration:

config system admin
edit "rad_usr"
set remote-auth enable
set accprofile "super_admin"
set vdom "root"
set wildcard enable
set remote-group "radis_gp"
next
end

Repeat the similar configuration on another FortiGate.

Verification:

Try to authenticate on both FortiGates using the user 'test12', the user will get an OTP prompt and enter the OTP on the first FortiGate, the user will successfully log to the FortiGate, then immediately try to enter the OTP on the second FortiGate, and the user will not be able to log in.

Find the below logs from the authenticator for working and not working login attempts.

Working:

Conclusion:

The Token generates a one-time password (OTP), which becomes invalid after use and cannot be reused. If the user attempts to use the same Token code again, an error will occur because the previous OTP has already been consumed. Users need to wait for the next Token and authenticate.
The default time is 60 seconds and this can be changed under Authentication -> User Account Policies -> Token -> Time Step (30 or 60 seconds).
Alternatively, choose to use 'HOTP'. Using this the OTP will automatically change, once used. This bears a higher risk of the OTP being visible for some time as in turn the OTP will be valid as long as it isn't used.
Both of these settings, as well as the others on this screen, apply only to newly provisioned FortiToken Mobile. They will not affect already provisioned Tokens.