Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
HTGreg
New Contributor

Correct Method for MSP Co-Management with MFA

As an MSP, we co-manage firewalls with in-house IT.   Combination of leased and customer owned appliances.  We have all customers in our FortiGate Cloud MSP edition instance.    Technicians are all setup with individual cloud accounts and forced MFA.   In-house IT takes the included tokens.  

 

For other systems, we have a shared MSP login with TOTP key entered into our password management system.   Password management is protected by individual logins with MFA.   IT Glue….   I believe this is pretty common.   

The problem lies in three spots.  

1.  We cannot add a FortiToken to any password management system.    We have to manually add/remove technicians.   This is a huge security blunder waiting to happen.   
2.   FortiTokens expense would get unreal.   We have many clients that are T&M.    We don’t get paid to have access, but when we get called, we need secure access.   
3.  Since the appliance must be registered with the primary forticloud account, we cannot MFA it.    Technicians need to be able to add appliances without waiting on the token holder to respond.   

We looked at FortiManager, but it was more designed for a single company applying policies over a large deployment.   Our clients are extremely different in needs.   As such, it is more effective to manage directly from the appliance.  

 

We tried doing the login via cloud; however, that only worked for the primary account.   

 

Many years ago, there was a forum post on asking TOTP abilities.    Yes, it is less secure; however, the barriers to implementation make the FortiGates less secure.   

What is the best method to address the following:

 

- enable MFA on the master account

- provide remote access logins for technicians.  

10 REPLIES 10
sjoshi
Staff
Staff

To address the challenges you are facing as an MSP managing multiple client firewalls, you can consider the following approach: Enable MFA on the master account by using FortiToken Cloud service, which offers a cost-effective and scalable solution for managing multifactor authentication. For providing remote access logins for technicians without relying on physical tokens, you can utilize FortiToken Mobile Tokens included in FortiToken Cloud, allowing technicians to authenticate securely using their mobile devices. This setup ensures strong security measures while offering flexibility and ease of access for your team members managing various client appliances.

Let us know if this helps.
Salon Raj Joshi
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors