Google Authenticator instead of FortiToken?

[Jay_Libove]

Since FortiToken is OAUTH compliant, can we not use Google Authenticator instead? Anyone been able to work that out? thanks,

[Jay_Libove · Accepted solution]

One more thing that comes to mind, FortiNet itself doesn' t need to be involved in a 2-factor authentication solution at all. The FortiGate appliance is the seed and authentication server. A FortiToken or Google Authenticator or any other OAUTH compliance soft token is the end-user device. The communication goes over the same Internet connection which the user and the FortiGate must have in order for the whole idea to be useful anway. So for FortiGate to put itself in the middle, and offer an expensive service, and not include the 2-factor server in FortiOS for those customers who are happy to run it themselves, seems to me to just be a way to try to squeeze more money out of the customers, without providing additional value. (It also makes FortiNet' s servers a potential point of failure).

[Dipen]

Not sure if Google Authenticator is supposed to work with 3rd Party Applications. I am using it for Google Applications currently...Its very good.

[Jay_Libove]

Google Authenticator is used by many non-Google sites. Amazon AWS, for example. And Microsoft Hotmail (' scuse me, " outlook.com" ). And LastPass. And Facebook. And.... So, yes, it could be made to work with FortiGate. The question is, why doesn' t FortiNet enable it?

[dred_FTNT]

Fortinet offers FortiToken Mobile (FTM) as its mobile OTP app. FTM is more secure than Google Authenticator in the way the OTP seeds (shared secrets) are provisioned to the app. GA simply accepts base32 encoded seed values, which make the tokens on GA vulnerable. FTM uses dynamic seed creation and transmits the seeds in AES encrypted format to the app, where the seeds are encrypted and bound to the device. FTM version 2 for iOS and Android (BB10 is coming) supports third party tokens (Google, Dropbox, Amazon, etc.), all for free. So why not use FTM instead of GA?

[Jay_Libove]

Hi dred, I' m not sure, when you say " FTM version 2 .. supports third party tokens .... So why not use FTM instead of GA?" , whether you are saying that I can use FTM for free in whatever quantity I want with my FortiGate 100D appliance. I doubt it, based on the exorbitant price quote I got from my local FortiNet partner for FortiToken licenses this week. Even if FTM is slightly more secure, we' re not looking for perfect security, we' re looking for useful security against far-remote attacks. A token, any token, Google Authenticator or FortiToken Mobile, for us is principally to prevent the theft of a password from being sufficient to gain remote access to our resources. FTM (on device) being more secure than GA (on device) is of little concern to me, as if the device itself is lost or stolen, the principal security control is that the employee promptly report the loss/theft and we disable the credential. (That said, it would be good for Google to add a PIN option). My goal is to not have to pay €80/soft token to FortiNet for a service which many other sites offer for free. We always have to remember, as security people, that security does not exist in a vacuum. Security generally should not be ' perfect' because that will almost surely impose costs in money and/or usability which are unsustainable to our organizations. So, are you saying that I can add however many more token users I want to my FG100D for free? .. or just that I could use FortiToken Mobile instead of Google Authenticator for non-FortiNet things (which is of no interest to me). thanks, -Jay

ORIGINAL: dred Fortinet offers FortiToken Mobile (FTM) as its mobile OTP app. FTM is more secure than Google Authenticator in the way the OTP seeds (shared secrets) are provisioned to the app. GA simply accepts base32 encoded seed values, which make the tokens on GA vulnerable. FTM uses dynamic seed creation and transmits the seeds in AES encrypted format to the app, where the seeds are encrypted and bound to the device. FTM version 2 for iOS and Android (BB10 is coming) supports third party tokens (Google, Dropbox, Amazon, etc.), all for free. So why not use FTM instead of GA?

[Hoygen]

Anyone has been able to set up google authenticator instead of fortitoken?

[emnoc]

Man this a old thread pulled way from the past. As far as Google  being less secured it's a highly recognized solution  and widely accepted.

I have used 3rd party MFA solutions with  FTNT 

http://socpuppet.blogspot.com/2017/04/securing-fortigate-sslvpn-with-mfa-by.html

[Joe667]

Just a quick note regarding Duo. I presently use Duo for 2FA on my SSL VPN. The plan I am on ($10/mo for each group of 10 users) is no longer offered and will be discontinued this year. To continue with Duo will be around $3/mo per user. Compared to the one-time price of a FortiToken, it's a no-brainer. To duplicate the push authentication of Duo you need to employ a FortiAuthenticator (lists at approx $3200, plus $800/year maintenance). I can't find a better deal than the Fortinet solution.

[ispcolohost]

Duo is far more than just a second factor though.  For the relatively low cost, it also lets me do a large variety of other things, like not allowing a mobile device with out of date OS be used as the second factor, restrict, or require additional auth, if the request is from a certain country or non-whitelisted country, set restrictions for a given person on a per-app basis instead of them having to have one TOTP solution for Fortigate VPN, one for application X, a third for application Y, etc., log accesses in an easy to use manner, finally, it has a method for secure self re-enrollment should their primary device be rendered unusable.  If a Fortitoken app device gets lost, guess what, they're calling IT who then will likely have to walk through a cumbersome set of steps to truly auth that user and get them a new Fortitoken code, or if the device is stolen, now you have to find a firewall admin to deal with locking the old token out, there's no good audit trail, etc.  It's just a huge pain for an entity of reasonable size; Fortitoken, and FortiAuth for that matter, are not scalable or cost effective solutions; they're just a headache.

Besides all that though, I'm simply annoyed that Fortinet is choosing to monetize TOTP at the expense of offering much more comprehensive security solutions; their FortiToken is nothing more than TOTP that they're not letting you have the key for.  I'd prefer to pay more for my hardware, or my support contract, and not deal with petty nickel-and- diming.

[axot]

If you could dump the seed, then you can get it to work in other applications.

Here is a ruby script for example.

```

totp = ROTP::TOTP.new(seed, interval: 60) print totp.now ```