Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
HTGreg
New Contributor

Correct Method for MSP Co-Management with MFA

As an MSP, we co-manage firewalls with in-house IT.   Combination of leased and customer owned appliances.  We have all customers in our FortiGate Cloud MSP edition instance.    Technicians are all setup with individual cloud accounts and forced MFA.   In-house IT takes the included tokens.  

 

For other systems, we have a shared MSP login with TOTP key entered into our password management system.   Password management is protected by individual logins with MFA.   IT Glue….   I believe this is pretty common.   

The problem lies in three spots.  

1.  We cannot add a FortiToken to any password management system.    We have to manually add/remove technicians.   This is a huge security blunder waiting to happen.   
2.   FortiTokens expense would get unreal.   We have many clients that are T&M.    We don’t get paid to have access, but when we get called, we need secure access.   
3.  Since the appliance must be registered with the primary forticloud account, we cannot MFA it.    Technicians need to be able to add appliances without waiting on the token holder to respond.   

We looked at FortiManager, but it was more designed for a single company applying policies over a large deployment.   Our clients are extremely different in needs.   As such, it is more effective to manage directly from the appliance.  

 

We tried doing the login via cloud; however, that only worked for the primary account.   

 

Many years ago, there was a forum post on asking TOTP abilities.    Yes, it is less secure; however, the barriers to implementation make the FortiGates less secure.   

What is the best method to address the following:

 

- enable MFA on the master account

- provide remote access logins for technicians.  

8 REPLIES 8
gallon6341
New Contributor

Vakio bebe kokoa eto.

TPmat
New Contributor

Did you ever manage to find a proper solution for this? We're facing a similar issue ourselves and are looking into it.

BenGadget
New Contributor

@HTGreg I also have this problem, did you ever figure out a solution?

NSE 1-5,7
NSE 1-5,7
gregbeason
New Contributor

Unfortunately, I never did find a solution.   Now my CEO wants to move us over to SonicWalls because the FortiGates are not protected.  

BenGadget

@gregbeason 

Hey I did find a way.

We can use Azure SAML to do MFA for all of our administrator needs with our users, but let the client use the FortiTokens for MFA that come with the firewall.

NSE 1-5,7
NSE 1-5,7
gregbeason

Before I go down a Rabbit Hole, is SAML allowing you to not pre-add administrators?   Any chance you are working with Duo?  

I'm also assuming you are referring to this article.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-SAML-SSO-login-for-FortiGate/t...

BenGadget

I’ll try to take a look at that article in a while. It does work with duo,we do not have to pre-add administrators, you just set up the identity source under the security fabric section but you do not have to turn on security fabric.

NSE 1-5,7
NSE 1-5,7
gregbeason

Thanks!   I'll probably grab one of our spares and try this out.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors