Technical Tip: How To Set up Two-Factor Authentication (2FA) for FortiGate Admin Access Using FortiAuthenticator

[ManpreetSingh]

Description	This guide provides a step-by-step process for setting up Two-Factor Authentication (2FA) on FortiGate devices admin access using FortiAuthenticator.
Scope	FortiGate, FortiAuthenticator.
Solution	Creating a User Account and Assigning a FortiToken on FortiAuthenticator. Log in to FortiAuthenticator. Navigate to Authentication -> User Management -> Local Users. Select 'Create New' and add user details. Enable RADIUS Authentication. Enable One-Time Password (OTP) Authentication. For Deliver token codes, select FortiAuthenticator. For Deliver token code by, select FortiToken -> FortiToken Mobile and then select the token. Select OK to save the configuration. Configuring RADIUS Policy on FortiAuthenticator. Step 1: Define RADIUS Client. Log in to FortiAuthenticator. Navigate to Authentication-> RADIUS Service -> Clients. Select Create New. Enter the details: Name: FortiGate. IP Address: IP address of FortiGate. Secret: Shared secret to be used with FortiGate. Select OK to save the configuration. Step 2. Configure RADIUS Policy. Go to Authentication -> RADIUS Service -> Policies. Select Create New. Enter a name for the policy (e.g.,FortiGate-Admin-Access ).  Select RADIUS Client. In the Clients section, select the RADIUS client (FortiGate) created earlier.  Define RADIUS Attribute Criteria. In the Conditions section, set the conditions to match the incoming requests. This section can be left as default if no specific criteria are needed. Select Next.  Authentication. In the Authentication section, select the authentication method as Password + OTP. Select Next.  Identity Source. In the Identity Source section, select the Local User Realm. Optionally, select any group to filter using a specific group. Select Next.  Authentication Factors. In the Authentication Factors section, ensure Mandatory Password and OTP are selected. Select Next.  Save the RADIUS Response. Leave the RADIUS Response settings as they are. Select OK to save the policy.   Configure FortiAuthenticator as a RADIUS Server on FortiGate. Log in to FortiGate. Navigate to User & Authentication -> RADIUS Servers. Select Create New. Enter the details: Name: FortiAuthenticator. IP/Name: IP address of FortiAuthenticator. Secret: Shared secret configured on FortiAuthenticator. Select OK to save. Enabling Admin Access on FortiGate Using FortiAuthenticator as RADIUS Step 1: Create a User Group and Select the RADIUS Server. Log in to the FortiGate. Navigate to User & Authentication -> User Groups. Select Create New. Enter a name for the user group (e.g., RADIUS-Admin-Group). In the Remote Server section, select Add. Select the RADIUS server (FortiAuthenticator) previously configured. Select OK to save the user group. Step 2: Configure Administrator Accounts for 2FA. Go to System -> Administrators. Select Create New. Select Match all users in a remote-server group. Enter a name for the administrator. In the Remote User Group dropdown, select the user group created in Step 1 (RADIUS-Admin-Group). Assign an appropriate admin profile from the Admin Profile dropdown. Select OK to save the configuration.