Description | This article describes in detail how FortiAuthtenticator Push notification works. |
Scope | FortiAuthenticator, FortiGate. |
Solution |
1) FortiGate first forwards the user credentials in the Access-Request packet to the FortiAuthenticator server.
Example below for illustration:
5) FortiAuthenticator then contacts the first IP on the list and starts a TLS handshake with the selected server. An encrypted communication, signed by certificates, is then established between those ones.
2021-07-22T13:41:28.628819+02:00 FAC pushd[1267]: MAIN: #012Stats:#011 workers=1#011 quest=0#012#011Worker[139952154474240] worked on last quest at 2021-07-22 11:03:16.308986
As mentioned, this data is TLS encrypted, signed, and sent to Apple/Android notification service, which then in return sends a notification message to the specified mobile device.
The mobile phone is Apple device in this case which is why the DNS query toward push-apple.com is seen in the case it is wanted to capture the WAN traffic on FortiGate.
7) FortiToken Mobile app is then used to process notifications and shows a pop-up with login details. Then OTP token or access Approve/Deny response is sent securely in the background from the mobile app to FortiAuthenticator.
8) When a response from the FortiToken Mobile app is received, RADIUS Access-Accept (Approve) or Access-Reject (Deny) is sent from FortiAuthenticator to RADIUS Client. |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.