Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
potapnev
New Contributor

2FA with RADIUS

FortiOS 6.2.5
Are there any instructions how to create email or certificate-based 2FA for RADIUS users?

10 REPLIES 10
Anthony_E
Community Manager
Community Manager

Hello potapnev,

 

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.


Regards,

Anthony-Fortinet Community Team.
JeremyNV

Hello
Any ideas?

gfleming

You've been given excellent responses already. If you aren't happy with the solution provided using FortiGate as email provider, you need to look at your RADIUS server to provide this functionality.

Cheers,
Graham
gfleming
Staff
Staff

This would be a function of your RADIUS server. Which RADIUS server are you using.


The FortiGate only acts as a RADIUS client...

Cheers,
Graham
bpozdena_FTNT

1. Email token delivery:

config user local
    edit "user1"
        set type radius
        set two-factor email
        set email-to "user1@example.com"
        set radius-server "my_radius_server"
    next
end

You can also use your custom SMTP server. 

 

 

2. Certificate based SSL VPN authentication:

HTH,
Boris
JeremyNV

In the email token option I'll need to add every user manually? Or it will take emails from radius server for every user?

Markus_M

Hi Jeremy,

 

every user needs to be manually configured, if the second factor is set on the FortiGate.

If the second factor is set on another server like RADIUS, it will have to be configured there. FortiAuthenticator can import users from LDAP and automatically read the email address of that user, assign FortiToken Mobile and send the FortiToken Mobile activation to the email address that was imported. "Remote user sync rules" are the trick.

 

Best regards,

 

Markus

JeremyNV

Any examples of configuring 2FA on RADIUS so that it could be used by FortiClient?

Sx11

Hi Jeremy,

 

regarding the scenario where FortiAuthenticator will act as radius server you can use the following documentation:

https://docs.fortinet.com/document/fortiauthenticator/6.4.0/cookbook/278744/fortitoken-mobile-push-f...

https://docs.fortinet.com/document/fortiauthenticator/6.4.0/cookbook/997639/configure-ldap-users-on-...

 

Regards

S

sx11
Labels
Top Kudoed Authors