Description
This article describes the steps to configure Two Factor Authentication on FortiGate with token delivery to user’s email.
Related document:
system email-server
Scope
FortiGate.
Solution
There are two steps to complete this configuration:
- Configure the SMTP server.
config system email-server
set reply-to {Sender_email_address}
set server {SMTP_server_FQDN/IP}
set port {SMTP_server_port_number}
set authenticate {enable | disable}
set username {username}
set password {password_string}
set security {none | starttls | smtps}
end
- Create a user(s) with email two-factor enabled.
config user local
edit {username}
set type password
set two-factor email
set email-to {user_email_address}
set passwd {password}
next
end
config system admin
edit "admin"
set type password
set two-factor email
set email-to user_email_address
set passwd password
next
end
Note:
Email based two-factor authentication can only be enabled via the CLI.
After enabling two-factor authentication and configuring where to send the 2FA emails via CLI, the Email-based two-factor authentication option will now show up via GUI. Take note that the Email 2FA option will be gone again once the administrator has changed the Two-factor authentication type back to either FortiToken or FortiToken Cloud. Email based two-factor authentication needs to be configured again via CLI.
The two-factor authentication can also be applied to LDAP users:
Configuring Two-Factor Authentication for LDAP users
Verification of Configuration:
Once the newly created user can access certain service (e.g. SSL-VPN), the user will be prompted for username and password as usual during access attempt.
If correct credentials are entered by the user, the user will be prompted to enter a token. This token will be delivered to the user’s mailbox. Once the user enters the received token, access will be granted.
Troubleshooting:
Debug commands can and should be combined to see the respective flow of authentication, handing over to the next process and seeing when a response is sent from the client. As timeouts may occur, adding a timestamp to each debug line will help to identify them:
diag debug reset
diag debug console timestamp enable
diag debug application fnbamd -1
diag debug application alertmail -1
diag debug enable
Related articles:
Correctly configuring Two-Factor Authentication for LDAP users using SSL VPN
Add Two-Factor Authentication for FortiGate Administrators using FortiToken
