FortiAuthenticator
FortiAuthenticator provides centralized authentication services for the Fortinet Security Fabric including multi-factor authentication, single sign-on services, certificate management, and guest management.
jhussain_FTNT
Article Id 388682
Description

This article describes how to activate FortiToken Mobile in an Air-gap network.

Scope FortiAuthenticator v6.6.1 onward.
Solution

To activate the FortiToken Mobile license, it requires a temporary online connection to https://fortitokenmobile.fortinet.com

 

The FortiToken Mobile licensing must be validated and verified by FortiGuard Servers. The FortiAuthenticator must be online for this process to complete. An air-gapped FortiAuthenticator will not be able to activate it.

 

From FortiAuthenticator v6.6.1 onward, the FortiToken can be provisioned offline without connecting to the FortiGuard server.

 

Only a Hardware FortiToken can be used to activate/provision within an Air-gap network. Mobile FortiToken or Soft Token does not have a Seed file that can be uploaded. It is only retrievable from the https://fortitokenmobile.fortinet.com server (thus the need to be online temporarily).

 

To upload the Seed file to FortiAuthenticator, go to User Management -> FortiTokens -> Import FortiTokens -> Select Seed file and upload and save.

 

image.png

 

FortiToken Mobile can be assigned by changing the Provision mode to Offline:

 

Provision ModeProvision Mode

 

Once the FortiToken Mobile is assigned to a user, the following activation page will be presented:

 

FTM Offline ActivationFTM Offline Activation

 

Related document

FortiAuthenticator 6.6.1