Technical Tip: Alternative method to obtain admin account’s SMS two factor authentication activation code

[jkoay]

Description

A FortiGate with no valid SMS quota can cause login issues when SMS two factor authentication is accidentally enabled in the FortiGate’s admin account.

This article describes an alternative method to obtain admin account’s SMS two factor authentication activation code.

Scope

FortiGate.

Solution

1. Access the FortiGate via console cable.
   
   
2. In the CLI console, execute the following commands:

diag debug reset
diag debug disable
diag debug app forticldd 255
diag fortitoken debug enable
diag debug enable

3. Login to FortiGate with an alternative super_admin account. Access to System -> Administrator, select admin account that was configured with SMS two factor authentication and select 'Send SMS Activation Code'.
   
   
4. Similar output on the console with FortiToken activation code being sent out will be visible

5. Activate the two-factor authentication via FortiToken Mobile Application with the activation code obtained from CLI console.
   
   
6. To disable debugs:

diag debug disable