Correct Method for MSP Co-Management with MFA

[HTGreg]

As an MSP, we co-manage firewalls with in-house IT.   Combination of leased and customer owned appliances.  We have all customers in our FortiGate Cloud MSP edition instance.    Technicians are all setup with individual cloud accounts and forced MFA.   In-house IT takes the included tokens.  

For other systems, we have a shared MSP login with TOTP key entered into our password management system.   Password management is protected by individual logins with MFA.   IT Glue….   I believe this is pretty common.   

The problem lies in three spots.  

1.  We cannot add a FortiToken to any password management system.    We have to manually add/remove technicians.   This is a huge security blunder waiting to happen.   
2.   FortiTokens expense would get unreal.   We have many clients that are T&M.    We don’t get paid to have access, but when we get called, we need secure access.   
3.  Since the appliance must be registered with the primary forticloud account, we cannot MFA it.    Technicians need to be able to add appliances without waiting on the token holder to respond.   

We looked at FortiManager, but it was more designed for a single company applying policies over a large deployment.   Our clients are extremely different in needs.   As such, it is more effective to manage directly from the appliance.  

We tried doing the login via cloud; however, that only worked for the primary account.   

Many years ago, there was a forum post on asking TOTP abilities.    Yes, it is less secure; however, the barriers to implementation make the FortiGates less secure.   

What is the best method to address the following:

- enable MFA on the master account

- provide remote access logins for technicians.  

[gallon6341]

Vakio bebe kokoa eto.

[TPmat]

Did you ever manage to find a proper solution for this? We're facing a similar issue ourselves and are looking into it.

[BenGadget]

@HTGreg I also have this problem, did you ever figure out a solution?

[gregbeason]

Unfortunately, I never did find a solution.   Now my CEO wants to move us over to SonicWalls because the FortiGates are not protected.  

[BenGadget]

@gregbeason 

Hey I did find a way.

We can use Azure SAML to do MFA for all of our administrator needs with our users, but let the client use the FortiTokens for MFA that come with the firewall.

[gregbeason]

Before I go down a Rabbit Hole, is SAML allowing you to not pre-add administrators?   Any chance you are working with Duo?  

I'm also assuming you are referring to this article.
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-SAML-SSO-login-for-FortiGate/t...

[BenGadget]

I’ll try to take a look at that article in a while. It does work with duo,we do not have to pre-add administrators, you just set up the identity source under the security fabric section but you do not have to turn on security fabric.

[gregbeason]

Thanks!   I'll probably grab one of our spares and try this out.