Fortianalyser MFA

[pintail120]

Hi,

Please can it be clarified why the Fortigate firewalls have MFA functionality using email without subscription(free) as opposed to Fortianalyser that only offers the Token subscription based option for MFA(no free version) ?

kind regards

Gavin

[AEK]

Hi

I guess this is for marketing purpose.

However if you don't have FortiAuthenticator/FortiToken, I think you can do it with third party RADIUS server, I mean you configure RADIUS authentication on your FAZ and configure e-mail OTP on your RADIUS server (if your RADIUS supports it).

[pintail120]

Thank you for your reply,

Please can you confirm this solution does not use Fortitokens which are the paid up route ?

On this website on page 25 it refers to tokens ?

Fortianalyser MFA 

[AEK]

Page 25 is about FortiAuthenticator, which as far as I know supports many MFA options, like FortiToken, e-mail, SMS gateway, and I guess (not sure) other third party token solutions.

So the example in page 25 mentions FortiToken but it is not the only possible option.

[Yurisk · Accepted solution]

I think you misunderstood the Fortianalyzer (FAZ) guide - yes, indeed it lists for MFA either FOrtiCLoud or FortiAuthenticator (FAC), BUT ... these are external to the FAZ solutions any way. That is - FAZ itself does not have any MFA built-in. And those listed are just a suggestion (obviously beneficial to the Fortinet (FTNT)). Later in the same guide they tell how to connect your FAZ to other external authentication providers - LDAP/RADIUS, using which you can enable MFA for admins with not only FTNT products, but any other product you already have - Okta/MS/etc. 

https://docs.fortinet.com/document/fortianalyzer/7.4.3/administration-guide/681142/radius-servers

As regards Fortigate (FGT) - actually it is the only device (to the best of my knowledge) that has MFA capabilities baked in, as after all it is the perimeter Internet-facing device subjected most to the malicious attempts. FAZ/FMG/etc, on the other hand, you never leave open/accessible to the Internet, but put behind the firewall, and so MFA as built-in feature becomes less of an benefit IMO.