2FA with RADIUS

[potapnev]

FortiOS 6.2.5
Are there any instructions how to create email or certificate-based 2FA for RADIUS users?

[Anthony_E]

Hello potapnev,

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Regards,

[JeremyNV]

Hello
Any ideas?

[gfleming]

You've been given excellent responses already. If you aren't happy with the solution provided using FortiGate as email provider, you need to look at your RADIUS server to provide this functionality.

[gfleming]

This would be a function of your RADIUS server. Which RADIUS server are you using.

The FortiGate only acts as a RADIUS client...

[bpozdena_FTNT]

1. Email token delivery:

config user local
    edit "user1"
        set type radius
        set two-factor email
        set email-to "user1@example.com"
        set radius-server "my_radius_server"
    next
end

You can also use your custom SMTP server. 

2. Certificate based SSL VPN authentication:

• https://community.fortinet.com/t5/FortiGate/Technical-Tip-Combining-remote-user-authentication-and-c...
• You can also just enable client certificate authentication on the SSL VPN server: https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/266506/ssl-vpn-with-certificate-authenti... 

[JeremyNV]

In the email token option I'll need to add every user manually? Or it will take emails from radius server for every user?

[Markus_M]

Hi Jeremy,

every user needs to be manually configured, if the second factor is set on the FortiGate.

If the second factor is set on another server like RADIUS, it will have to be configured there. FortiAuthenticator can import users from LDAP and automatically read the email address of that user, assign FortiToken Mobile and send the FortiToken Mobile activation to the email address that was imported. "Remote user sync rules" are the trick.

Best regards,

Markus

[JeremyNV]

Any examples of configuring 2FA on RADIUS so that it could be used by FortiClient?

[Hatibi]

Hi Jeremy,

regarding the scenario where FortiAuthenticator will act as radius server you can use the following documentation:

https://docs.fortinet.com/document/fortiauthenticator/6.4.0/cookbook/278744/fortitoken-mobile-push-f...

https://docs.fortinet.com/document/fortiauthenticator/6.4.0/cookbook/997639/configure-ldap-users-on-...

Regards

S