Technical Tip: How to use same FortiToken Cloud for a user on multiple Fortinet Devices for Administrator Login

[auppal]

Description

This article describes that One FortiToken from the FortiToken cloud for a particular user can be used for administrator login on multiple Fortinet devices.  

Scope

FortiToken Cloud, FortiGate.

Pre-requisite

FortiToken Cloud contract license is valid and registered.

Solution

In order to use one FortiToken cloud for one user for multiple Fortinet device logins, the following 3 conditions must match:

1. Fortinet Devices in the same realm on FortiToken Cloud. 
2. The same username to be used for a user on all Fortinet devices 
3. The same email is to be used for a user on all Fortinet devices 

Example:

Username: fortinet-token.
Devices: FortiGate and FortiManager/FortiAnalyzer.
 

Note.

The username can be anything, 'fortinet-token' is used as an example only.  
 

1. Make sure that both devices are in the same realm on the FortiToken Cloud.
   
   On the FortiToken Cloud portal, Navigate to Auth Clients -> FortiProducts -> Check Realm.

As seen, both devices are in the same Realm 'default'.

Create a local administrator user on the FortiGate with username 'fortinet-token'.

Navigate to System -> Administrators -> Create new -> Administrator.

2. Enable Two-Factor Authentication -> Set the Authentication Type to FortiToken Cloud -> Provide the Email address of the user.
   
   
3. Similarly in FortiManager/FortiAnalyzer, create a local administrator with the same username 'fortinet-token' and email and set the FortiToken Cloud to FortiToken Mobile. Navigate to System Settings -> Administrators -> Create New.
   
   
4. Install the FortiToken Mobile application on Android/iOS and register the FortiToken according to the steps mentioned in the email received on the user’s email provided above.
5. Check 'Auth Client Count' on the FortiToken Cloud portal that the username is associated with 2 devices.

Note: 2 devices are seen in this case, it should show the number of devices that particular username is used with FortiToken Cloud.

On the FortiToken Cloud portal, Navigate to Users -> check Auth Client Count.

It is also possible to check which devices this user is associated with by selecting Auth Client Count.

Once the FortiToken Mobile Application, is set up, try to login into either of the two devices, and for both devices, the same FortiToken should be used to authenticate.

Related documents:
The same token for the same user on multiple auth clients
A single FTC user in multiple auth clients