Is it possible to use the FortiToken 410 for authentication beyond the FortiGate firewall?

[rvanhilst]

I'm on the verge of buying the FortiToken 410, but it comes in a 5-pack and I'm running a one-man show network. Can I use the FortiToken for authentication on other platforms—like my email account, web hosting provider, or password manager?

Your answer is very much appreciated :) Thanks in advance <3

[rbraha · Accepted solution]

Hi @rvanhilst 

FortiToken 410  supports FIDO U2F and FIDO2 protocols can be deployed with FortiAuthenticator ,FortiToken Cloud or Managing the device PIN, please check the guide below.

https://docs.fortinet.com/document/fortitoken/latest/fortitoken-410-deployment-guide/639061/deployme...

[rbraha · Accepted solution]

Hi @rvanhilst 

FortiToken 410  supports FIDO U2F and FIDO2 protocols can be deployed with FortiAuthenticator ,FortiToken Cloud or Managing the device PIN, please check the guide below.

https://docs.fortinet.com/document/fortitoken/latest/fortitoken-410-deployment-guide/639061/deployme...

[rvanhilst · Accepted solution]

Thank you for your reply :) I checked the documentation before asking but I missed this.

Answer: "FortiToken 410 supports the FIDO U2F and FIDO2 protocols, so you can use it for passwordless authentication with any system (such as your Google account) that supports these protocols." Meaning you can use the tokens for other services as well, such as Protonmail, Google, Icloud, etc.

[rvanhilst]

Hi Rbraha,

I have the 410 FortiTokens in my possession but feel lost on the activation process. When I attach a token and try to add it to FortiOS, nothing registers—no command line output, and I don’t see any serial number or seed. Most forum resources focus on mobile tokens.

Because of this—and to avoid the risks (unauthorized access, MITM attacks, spoofing, DoS, etc.) outlined in the FortiOS guide—I’m holding off connecting my FortiGate online until I’ve activated my FortiTokens. I haven’t even activated my license yet and am wondering if that can also be done offline.

Any advice or workarounds for safely activating both my license and FortiTokens using an ultra-secure, offline-first method would be greatly appreciated.

Thanks in advance.

[JHofsiss]

The FTK-410-5 hardware tokens are compatible with FortiGates, but only when used through FortiIdentity Cloud or FortiAuthenticator. FortiGate does not support direct registration of FIDO-based hardware tokens like the 410. You need FortiIdentity Cloud or FortiAuthenticator to manage and provision these tokens.

Per-user licensing means you only need one license per user who will use a token. If you have 1 user, you need 1 license, even if you’re buying from the 25-499 user SKU. The SKU range defines the pricing tier, not the minimum purchase quantity. We assumed a one-year contract.

FortiCloud Analytics is not required for FortiToken hardware activation, but the FortiGate must be registered under a FortiCloud account, and you need an active FortiIdentity Cloud subscription to manage the tokens.

You’ll need to:

1. Purchase FortiIdentity Cloud licenses (one per user).
2. Register the FortiGate under FortiCloud (if not already).
3. Activate the FortiIdentity Cloud subscription under the same FortiCloud account.
4. Provision the FortiToken 410s via FortiIdentity Cloud.