As an MSP, we co-manage firewalls with in-house IT. Combination of leased and customer owned appliances. We have all customers in our FortiGate Cloud MSP edition instance. Technicians are all setup with individual cloud accounts and forced MFA. In-house IT takes the included tokens.
For other systems, we have a shared MSP login with TOTP key entered into our password management system. Password management is protected by individual logins with MFA. IT Glue…. I believe this is pretty common.
The problem lies in three spots.
1. We cannot add a FortiToken to any password management system. We have to manually add/remove technicians. This is a huge security blunder waiting to happen.
2. FortiTokens expense would get unreal. We have many clients that are T&M. We don’t get paid to have access, but when we get called, we need secure access.
3. Since the appliance must be registered with the primary forticloud account, we cannot MFA it. Technicians need to be able to add appliances without waiting on the token holder to respond.
We looked at FortiManager, but it was more designed for a single company applying policies over a large deployment. Our clients are extremely different in needs. As such, it is more effective to manage directly from the appliance.
We tried doing the login via cloud; however, that only worked for the primary account.
Many years ago, there was a forum post on asking TOTP abilities. Yes, it is less secure; however, the barriers to implementation make the FortiGates less secure.
What is the best method to address the following:
- enable MFA on the master account
- provide remote access logins for technicians.
To address the challenges you are facing as an MSP managing multiple client firewalls, you can consider the following approach: Enable MFA on the master account by using FortiToken Cloud service, which offers a cost-effective and scalable solution for managing multifactor authentication. For providing remote access logins for technicians without relying on physical tokens, you can utilize FortiToken Mobile Tokens included in FortiToken Cloud, allowing technicians to authenticate securely using their mobile devices. This setup ensures strong security measures while offering flexibility and ease of access for your team members managing various client appliances.
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1841 | |
1128 | |
769 | |
447 | |
258 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2025 Fortinet, Inc. All Rights Reserved.