{"id":248473,"date":"2026-11-06T00:00:13","date_gmt":"2026-11-06T00:00:13","guid":{"rendered":"https:\/\/logmeonce.com\/resources\/fortigate-multi-factor-authentication\/"},"modified":"2026-11-06T00:00:15","modified_gmt":"2026-11-06T00:00:15","slug":"fortigate-multi-factor-authentication","status":"publish","type":"post","link":"https:\/\/logmeonce.com\/resources\/fortigate-multi-factor-authentication\/","title":{"rendered":"FortiGate Multi-Factor Authentication: Setup Guide"},"content":{"rendered":"<div class=\"336cb5b64765e27a1a6c1bb71b941f1a\" data-index=\"1\" style=\"float: none; margin:10px 0 10px 0; text-align:center;\">\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-4830628043307652\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- above content -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-4830628043307652\"\r\n     data-ad-slot=\"5864845439\"\r\n     data-ad-format=\"auto\"\r\n     data-full-width-responsive=\"true\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<\/div>\n<\/p>\n<p>You can add multi-factor authentication (MFA) to a FortiGate in two ways. You can assign a second factor to local users, such as a FortiToken, email or SMS code. Or you can point the firewall at an outside authentication server over RADIUS or SAML, and let that server ask for the second factor. Either way, the firewall checks the password and then a one-time code before it lets a VPN user or an administrator in. This guide covers both routes, the prerequisites, and what to check when a login fails.<\/p>\n<div data-blg-cta=\"after_tldr\" data-blg-cta-layout=\"banner\" style=\"margin:28px 0;font-family:-apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif\">\n<div style=\"border-radius:26px;padding:min(22px,3.2vw)\">\n<div style=\"background:#ffffff;border-radius:18px;overflow:hidden\">\n<div style=\"padding:34px 30px;text-align:center\">\n<div style=\"margin:0 0 18px\"><span style=\"max-width:100%;border-radius:999px;padding:6px 13px;font-size:12px;font-weight:800;letter-spacing:0.1em;text-transform:uppercase;line-height:1.3;background:#F47F24;color:#ffffff\">Logmeonce<\/span><\/div>\n<div style=\"font-size:26px;font-weight:800;line-height:1.2;letter-spacing:-0.01em;color:#1f2937;margin:0\">Strengthen Security Beyond the Firewall<\/div>\n<div style=\"width:56px;height:6px;border-radius:3px;background:#F47F24;margin:12px 0 14px;margin-left:auto;margin-right:auto\"><\/div>\n<div style=\"font-size:15px;line-height:1.55;color:#64748b;margin:0 0 24px;max-width:44em;margin-left:auto;margin-right:auto\">Explore LogMeOnce resources on passwordless MFA and identity security to consider broader ways to protect accounts alongside your FortiGate.<\/div>\n<p><a href=\"https:\/\/logmeonce.com\/resources\" style=\"align-items:center;gap:9px;border-radius:10px;font-weight:700;font-size:15px;text-decoration:none;padding:13px 22px 13px 26px;background:#F47F24;color:#ffffff\">Explore security resources<\/a><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_77 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/logmeonce.com\/resources\/fortigate-multi-factor-authentication\/#TLDR\" >TL;DR<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/logmeonce.com\/resources\/fortigate-multi-factor-authentication\/#What_MFA_on_a_FortiGate_actually_protects\" >What MFA on a FortiGate actually protects<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/logmeonce.com\/resources\/fortigate-multi-factor-authentication\/#Choosing_your_MFA_method\" >Choosing your MFA method<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/logmeonce.com\/resources\/fortigate-multi-factor-authentication\/#Which_one_should_you_pick\" >Which one should you pick?<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/logmeonce.com\/resources\/fortigate-multi-factor-authentication\/#Enable_MFA_for_local_FortiGate_users\" >Enable MFA for local FortiGate users<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/logmeonce.com\/resources\/fortigate-multi-factor-authentication\/#Step_1_Register_the_token\" >Step 1: Register the token<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/logmeonce.com\/resources\/fortigate-multi-factor-authentication\/#Step_2_Configure_the_email_or_SMS_service\" >Step 2: Configure the email or SMS service<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/logmeonce.com\/resources\/fortigate-multi-factor-authentication\/#Step_3_Turn_on_two-factor_for_the_user\" >Step 3: Turn on two-factor for the user<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/logmeonce.com\/resources\/fortigate-multi-factor-authentication\/#Step_4_Apply_it_to_the_VPN_or_admin_login\" >Step 4: Apply it to the VPN or admin login<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/logmeonce.com\/resources\/fortigate-multi-factor-authentication\/#Use_RADIUS_and_a_central_authentication_server\" >Use RADIUS and a central authentication server<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/logmeonce.com\/resources\/fortigate-multi-factor-authentication\/#Prerequisites_that_trip_people_up\" >Prerequisites that trip people up<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/logmeonce.com\/resources\/fortigate-multi-factor-authentication\/#SSO_and_MFA_are_not_the_same_thing\" >SSO and MFA are not the same thing<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/logmeonce.com\/resources\/fortigate-multi-factor-authentication\/#Test_and_troubleshoot_a_failing_login\" >Test and troubleshoot a failing login<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/logmeonce.com\/resources\/fortigate-multi-factor-authentication\/#Protect_the_credentials_around_the_firewall\" >Protect the credentials around the firewall<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/logmeonce.com\/resources\/fortigate-multi-factor-authentication\/#Our_perspective\" >Our perspective<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/logmeonce.com\/resources\/fortigate-multi-factor-authentication\/#Put_identity_protection_around_your_firewall_with_LogMeOnce\" >Put identity protection around your firewall with LogMeOnce<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"https:\/\/logmeonce.com\/resources\/fortigate-multi-factor-authentication\/#A_rollout_checklist\" >A rollout checklist<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"https:\/\/logmeonce.com\/resources\/fortigate-multi-factor-authentication\/#FAQ\" >FAQ<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-19\" href=\"https:\/\/logmeonce.com\/resources\/fortigate-multi-factor-authentication\/#How_do_I_enable_multi-factor_authentication_on_a_FortiGate\" >How do I enable multi-factor authentication on a FortiGate?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-20\" href=\"https:\/\/logmeonce.com\/resources\/fortigate-multi-factor-authentication\/#Can_I_use_email_for_two-factor_authentication_on_my_FortiGate\" >Can I use email for two-factor authentication on my FortiGate?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-21\" href=\"https:\/\/logmeonce.com\/resources\/fortigate-multi-factor-authentication\/#Do_I_have_to_use_FortiToken\" >Do I have to use FortiToken?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-22\" href=\"https:\/\/logmeonce.com\/resources\/fortigate-multi-factor-authentication\/#Is_single_sign-on_the_same_as_MFA_on_FortiGate\" >Is single sign-on the same as MFA on FortiGate?<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-23\" href=\"https:\/\/logmeonce.com\/resources\/fortigate-multi-factor-authentication\/#Sources\" >Sources<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-24\" href=\"https:\/\/logmeonce.com\/resources\/fortigate-multi-factor-authentication\/#Recommended\" >Recommended<\/a><\/li><\/ul><\/nav><\/div>\n<h2 id=\"tldr\"><span class=\"ez-toc-section\" id=\"TLDR\"><\/span>TL;DR<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li>FortiGate supports MFA on user and administrator accounts. The simplest path is a FortiToken assigned to a local user. The scalable path is RADIUS to a central authentication server.<\/li>\n<li>FortiToken needs a FortiGuard subscription on the firewall. Email and SMS codes need a working mail or SMS service configured first.<\/li>\n<li>SSO is not MFA. It passes an identity along. A second factor only happens when the policy or backend demands one.<\/li>\n<li>When logins fail, test the RADIUS or LDAP path from the CLI, check shared secrets and group matching, and confirm the firewall clock is right.<\/li>\n<li>The accounts around the firewall matter too: protect the admin\u2019s own password vault and email with strong, unique credentials and MFA.<\/li>\n<\/ul>\n<h2 id=\"what-mfa-on-a-fortigate-actually-protects\"><span class=\"ez-toc-section\" id=\"What_MFA_on_a_FortiGate_actually_protects\"><\/span>What MFA on a FortiGate actually protects<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>A FortiGate has two kinds of logins worth protecting: the people who connect through it (remote VPN users, and anyone who authenticates to a firewall policy) and the people who manage it (administrators on the web GUI or SSH). A stolen password is enough to compromise either one if there is no second factor.<\/p>\n<p>Fortinet describes two-factor authentication as adding a second piece of information to a username and password logon, generally something you know plus something you have, such as a token or certificate. <a href=\"https:\/\/www.fortinetguru.com\/2016\/06\/two-factor-authentication\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">One community write-up of the feature<\/a> notes it can be applied to both user and administrator accounts, and that it does not work with explicit proxies. That last point matters if you run an explicit web proxy policy: plan a different control for that traffic.<\/p>\n<p>The exact menus and options depend on your FortiOS version. The examples below follow Fortinet\u2019s own documentation, and the menu names (User &amp; Authentication, FortiTokens, User Definition) have been stable across many releases. Always confirm against the administration guide for the firmware you run.<\/p>\n<h2 id=\"choosing-your-mfa-method\"><span class=\"ez-toc-section\" id=\"Choosing_your_MFA_method\"><\/span>Choosing your MFA method<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>FortiGate gives you several ways to deliver the second factor. Here is how they compare in practice.<\/p>\n<table>\n<thead>\n<tr>\n<th>Method<\/th>\n<th>How it works<\/th>\n<th>Best for<\/th>\n<th>What you need<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Hardware token (FortiToken 200 series)<\/td>\n<td>A small device shows a rotating code<\/td>\n<td>Admins and users who do not want a phone dependency<\/td>\n<td>Token registered on the firewall, FortiGuard subscription<\/td>\n<\/tr>\n<tr>\n<td>FortiToken Mobile<\/td>\n<td>An app generates codes, or receives a push<\/td>\n<td>Most remote workforces<\/td>\n<td>Activation by email or SMS, token licenses<\/td>\n<\/tr>\n<tr>\n<td>Email code<\/td>\n<td>A one-time code is sent to the user\u2019s address<\/td>\n<td>Small setups, fallback method<\/td>\n<td>Email service configured on the firewall, user email address<\/td>\n<\/tr>\n<tr>\n<td>SMS code<\/td>\n<td>A one-time code is sent by text<\/td>\n<td>Users without a token app<\/td>\n<td>SMS service, user phone number<\/td>\n<\/tr>\n<tr>\n<td>RADIUS to a central server<\/td>\n<td>The firewall forwards the login; the server checks password and code<\/td>\n<td>Larger organizations, many users, many devices<\/td>\n<td>RADIUS server, shared secret, user group mapping<\/td>\n<\/tr>\n<tr>\n<td>SAML single sign-on<\/td>\n<td>An identity provider handles login and MFA<\/td>\n<td>Organizations already standardized on a cloud identity platform<\/td>\n<td>SAML configuration, accurate clock<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>The Fortinet FortiToken guide says <a href=\"https:\/\/fortinetweb.s3.amazonaws.com\/docs.fortinet.com\/v2\/attachments\/a3e2887c-20eb-11e9-94bf-00505692583a\/FortiToken-5.4-Comprehensive_Guide.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">FortiToken Mobile and hardware tokens work for RADIUS, LDAP and 802.1X wireless as well as FSSO, and that the firewall needs a FortiGuard subscription to support FortiToken<\/a>. Check your licensing before you promise your team a rollout date.<\/p>\n<h3 id=\"which-one-should-you-pick\"><span class=\"ez-toc-section\" id=\"Which_one_should_you_pick\"><\/span>Which one should you pick?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>For one firewall and a few dozen users, local users with FortiToken Mobile are quick to deploy and need no extra server. Once you manage several firewalls, or you need the same MFA for VPN, Wi-Fi and applications, move authentication to a central RADIUS or SAML service so you enrol each person once.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/media.babylovegrowth.ai\/blog-images\/organization-6456\/1793822572582_Local-and-central-FortiGate-MFA-options-compared.jpeg\" alt=\"Local and central FortiGate MFA options compared\" title=\"\"><\/p>\n<p>Treat email and SMS as a fallback rather than your main method. They depend on the mail or phone network being available, and the code is only as safe as the inbox or SIM that receives it.<\/p>\n<h2 id=\"enable-mfa-for-local-fortigate-users\"><span class=\"ez-toc-section\" id=\"Enable_MFA_for_local_FortiGate_users\"><\/span>Enable MFA for local FortiGate users<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>This is the shortest route and works for both VPN users and administrators who are defined on the firewall itself.<\/p>\n<h3 id=\"step-1-register-the-token\"><span class=\"ez-toc-section\" id=\"Step_1_Register_the_token\"><\/span>Step 1: Register the token<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>On the FortiGate, go to <strong>User &amp; Authentication &gt; FortiTokens<\/strong> and select <strong>Create New<\/strong> for a hardware token, entering its serial number. Mobile tokens are provisioned from the same area. <a href=\"https:\/\/fortinetweb.s3.amazonaws.com\/docs.fortinet.com\/v2\/attachments\/a3e2887c-20eb-11e9-94bf-00505692583a\/FortiToken-5.4-Comprehensive_Guide.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Fortinet\u2019s guide to registering and assigning tokens<\/a> lays out this sequence.<\/p>\n<h3 id=\"step-2-configure-the-email-or-sms-service\"><span class=\"ez-toc-section\" id=\"Step_2_Configure_the_email_or_SMS_service\"><\/span>Step 2: Configure the email or SMS service<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>FortiToken Mobile activation codes travel by email or SMS. Under <strong>System &gt; Advanced<\/strong>, configure the email service. The same guide notes that the default mail port is 25, so confirm that your mail relay accepts the firewall and change the port if your relay requires another.<\/p>\n<h3 id=\"step-3-turn-on-two-factor-for-the-user\"><span class=\"ez-toc-section\" id=\"Step_3_Turn_on_two-factor_for_the_user\"><\/span>Step 3: Turn on two-factor for the user<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<ol>\n<li>Go to <strong>User &amp; Authentication &gt; User Definition<\/strong> and edit the user.<\/li>\n<li>Enable <strong>Two-factor Authentication<\/strong>.<\/li>\n<li>Set the authentication type to FortiToken and choose the token from the list.<\/li>\n<li>Enter the user\u2019s email address, or enable SMS and enter a phone number.<\/li>\n<li>Select <strong>OK<\/strong>, then check <strong>FortiTokens<\/strong> to confirm the token shows as assigned to the right person.<\/li>\n<\/ol>\n<p>The user receives an activation code by the method you chose. Activation codes expire after a configurable period, which you set in the CLI, so tell users to activate promptly after you assign the token.<\/p>\n<h3 id=\"step-4-apply-it-to-the-vpn-or-admin-login\"><span class=\"ez-toc-section\" id=\"Step_4_Apply_it_to_the_VPN_or_admin_login\"><\/span>Step 4: Apply it to the VPN or admin login<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Put the user in a user group, then reference that group in the SSL VPN or IPsec VPN settings and in the firewall policy that allows VPN traffic. For administrators, create the admin account with the same two-factor option enabled. After that, a login asks for the password first and then the token code.<\/p>\n<p>Test with a non-privileged account before you switch your own admin account. Keep one tested emergency admin path so a token problem cannot lock you out of the box.<\/p>\n<h2 id=\"use-radius-and-a-central-authentication-server\"><span class=\"ez-toc-section\" id=\"Use_RADIUS_and_a_central_authentication_server\"><\/span>Use RADIUS and a central authentication server<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>A RADIUS design keeps users and tokens off the firewall. The firewall acts as a RADIUS client and sends each login to the server. The server verifies the password and the one-time code and returns accept or reject.<\/p>\n<p>Fortinet\u2019s own cookbook for its authentication appliance walks through a <a href=\"https:\/\/fortinetweb.s3.amazonaws.com\/docs.fortinet.com\/v2\/attachments\/502fabff-dbf1-11ea-96b9-00505692583a\/FortiAuthenticator-6.2.0-Cookbook.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">push-notification MFA recipe for SSL VPN<\/a>. The pattern is the same whichever RADIUS-capable server you use:<\/p>\n<ol>\n<li>Create the user on the authentication server and assign a token license.<\/li>\n<li>Add the FortiGate as a RADIUS client, using its IP address and a shared secret.<\/li>\n<li>On the FortiGate, create a RADIUS server entry that points to the authentication server with the same secret.<\/li>\n<li>Create a user group on the FortiGate that uses that RADIUS server.<\/li>\n<li>Reference the group in the SSL VPN settings and the VPN firewall policy.<\/li>\n<\/ol>\n<p>The cookbook\u2019s recipe uses the same logic: connect the firewall to the RADIUS server, then create an SSL VPN that gives remote users internal access. It also adds that when a user must enter both a password and a token passcode, that is two-factor authentication.<\/p>\n<p>The same book includes a recipe for <a href=\"https:\/\/fortinetweb.s3.amazonaws.com\/docs.fortinet.com\/v2\/attachments\/502fabff-dbf1-11ea-96b9-00505692583a\/FortiAuthenticator-6.2.0-Cookbook.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">SAML with the authentication appliance acting as an identity provider proxy for a cloud directory<\/a>. If your company already uses a cloud identity platform such as Microsoft Entra ID, that path lets users keep one login and one MFA prompt across the VPN and their other apps.<\/p>\n<h3 id=\"prerequisites-that-trip-people-up\"><span class=\"ez-toc-section\" id=\"Prerequisites_that_trip_people_up\"><\/span>Prerequisites that trip people up<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<ul>\n<li><strong>Time.<\/strong> SAML and time-based codes depend on accurate clocks. Point the firewall at a reliable NTP source.<\/li>\n<li><strong>Reachability.<\/strong> The firewall must reach the RADIUS server on its authentication port, and the server must allow the firewall\u2019s address as a client.<\/li>\n<li><strong>Group matching.<\/strong> If the server returns a group attribute, the name must match what the firewall expects, or the user authenticates but lands in no policy.<\/li>\n<li><strong>Firmware.<\/strong> Menu paths and SSL VPN features change between FortiOS releases. Read the release notes for your version before an upgrade, and re-test MFA afterwards.<\/li>\n<\/ul>\n<h2 id=\"sso-and-mfa-are-not-the-same-thing\"><span class=\"ez-toc-section\" id=\"SSO_and_MFA_are_not_the_same_thing\"><\/span>SSO and MFA are not the same thing<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>People often ask whether setting up single sign-on on a FortiGate counts as MFA. It does not. Fortinet\u2019s user authentication documentation describes SSO as <a href=\"https:\/\/www.yumpu.com\/en\/document\/view\/7015690\/user-authentication-fortinet-technical-documentation\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">letting the firewall reuse an existing directory or Windows logon so users are not prompted again for permitted resources<\/a>. That is convenience: the identity is passed along.<\/p>\n<p>MFA is a separate requirement. It applies only when your policy or authentication backend demands an additional independent factor. A practical way to think about it: SSO answers who you are without asking again, and MFA makes sure that answer was backed by something the attacker would not have. If you use SSO with a cloud identity provider, enforce MFA there so the sign-in that the firewall trusts is already strong.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/media.babylovegrowth.ai\/blog-images\/organization-6456\/1793822610981_SSO-and-MFA-are-not-the-same-thing.jpeg\" alt=\"SSO and MFA are not the same thing\" title=\"\"><\/p>\n<h2 id=\"test-and-troubleshoot-a-failing-login\"><span class=\"ez-toc-section\" id=\"Test_and_troubleshoot_a_failing_login\"><\/span>Test and troubleshoot a failing login<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>When MFA does not work, work from the network inward.<\/p>\n<ol>\n<li><strong>Confirm the server path.<\/strong> Use the FortiGate CLI diagnostic command to test RADIUS or LDAP authentication with a known user. A reject with a clear reason is better than a silent timeout.<\/li>\n<li><strong>Check the shared secret.<\/strong> A mismatch is the most common cause of RADIUS failure, and it is easy to get wrong when copying secrets between systems.<\/li>\n<li><strong>Check connectivity.<\/strong> Confirm routing, source interface and any upstream firewall rules between the FortiGate and the server.<\/li>\n<li><strong>Check group matching.<\/strong> The user may authenticate but not match the group in the policy.<\/li>\n<li><strong>Watch the transaction.<\/strong> Running the authentication daemon debug (fnbamd) in the CLI shows each step of the login as it happens, according to <a href=\"https:\/\/infosecmonkey.com\/fortigate-authentication-settings-a-comprehensive-guide\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">one practitioner\u2019s authentication guide<\/a>. Turn debugging off afterwards.<\/li>\n<li><strong>Check the clock.<\/strong> For SAML and time-based codes, confirm the firewall time is accurate.<\/li>\n<\/ol>\n<p>If a user says the code is always wrong, check whether the token was assigned to the right account and whether the activation code expired before it was used.<\/p>\n<h2 id=\"protect-the-credentials-around-the-firewall\"><span class=\"ez-toc-section\" id=\"Protect_the_credentials_around_the_firewall\"><\/span>Protect the credentials around the firewall<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>MFA on the firewall is only as good as the accounts that surround it. The administrator\u2019s email receives the activation codes and password resets. The shared secret sits in a document somewhere. The VPN password may be reused on a dozen other sites.<\/p>\n<p>That is where a password manager and a second factor on those accounts close the gap. Use a long, unique password for each admin account, keep RADIUS secrets and break-glass credentials in an encrypted vault rather than a spreadsheet, and turn on MFA for the email inbox that receives recovery messages. Our guides on <a href=\"https:\/\/logmeonce.com\/blog\/two-factor-authentication\/what-is-2fa-the-importance-of-two-factor-authentication\" target=\"_blank\" rel=\"noopener\">what 2FA is and why it matters<\/a> and <a href=\"https:\/\/logmeonce.com\/blog\/two-factor-authentication\/the-business-benefits-of-two-factor-authentication\" target=\"_blank\" rel=\"noopener\">the business benefits of two-factor authentication<\/a> explain the reasoning in plain terms for non-specialists on your team.<\/p>\n<blockquote>\n<h2 id=\"our-perspective\"><span class=\"ez-toc-section\" id=\"Our_perspective\"><\/span>Our perspective<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Most firewall breaches we hear discussed start with a login, not an exploit: a reused password, an unprotected inbox, a shared admin credential. A second factor on the FortiGate is the right move, and we would go further and treat identity as the thing you are really defending.<\/p>\n<p>That means three habits. First, every admin and VPN user gets a unique password that nobody has to remember, which is exactly what a password manager is for. Second, the second factor should be easy enough that people do not look for ways around it. This is why we put so much into passwordless MFA and biometric options, which remove the code-typing step while keeping the strength. Third, the secrets that make the infrastructure work, such as RADIUS secrets and emergency credentials, belong in an encrypted vault with access control, not in a shared file.<\/p>\n<p>Our design is built for that whole picture: password management, MFA, single sign-on, and dark web monitoring, in plans that fit a single user or a managed service provider with many clients.<\/p>\n<p><em>Mike<\/em><\/p>\n<\/blockquote>\n<h2 id=\"put-identity-protection-around-your-firewall-with-logmeonce\"><span class=\"ez-toc-section\" id=\"Put_identity_protection_around_your_firewall_with_LogMeOnce\"><\/span>Put identity protection around your firewall with LogMeOnce<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Once the FortiGate has MFA, bring the rest of your team\u2019s logins up to the same standard. Our business plans cover password management, MFA and single sign-on for teams: Teams is $4.00 per month per user and Business is $7.99 per month per user, and Enterprise is available for larger organizations. See the <a href=\"https:\/\/logmeonce.com\/business-pricing-and-comparison\" target=\"_blank\" rel=\"noopener\">business plans and comparison<\/a> for what each tier includes.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/csuxjmfbwmkxiegfpljm.supabase.co\/storage\/v1\/object\/public\/blog-images\/organization-6456\/1760417791460_logmeonce.jpg\" alt=\"Logmeonce\" title=\"\"><\/p>\n<p>For an individual administrator or a small shop, the <a href=\"https:\/\/logmeonce.com\/password-manager\" target=\"_blank\" rel=\"noopener\">password manager plans<\/a> start with Professional at $2.50 per month, and our <a href=\"https:\/\/logmeonce.com\/passwordless-mfa\" target=\"_blank\" rel=\"noopener\">passwordless MFA<\/a> page explains how to sign in without typing codes. If you would like to see how our two-factor options work first, read the <a href=\"https:\/\/support.logmeonce.com\/hc\/en-us\/articles\/115012663307-Two-Factor-Authentication-Setup\" target=\"_blank\" rel=\"noopener\">two-factor authentication setup guide<\/a>.<\/p>\n<h2 id=\"a-rollout-checklist\"><span class=\"ez-toc-section\" id=\"A_rollout_checklist\"><\/span>A rollout checklist<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Before you enforce MFA for everyone, run through this list.<\/p>\n<ul>\n<li>Inventory who logs in: VPN users, admins, contractors, service accounts.<\/li>\n<li>Decide the method per group: tokens for admins, mobile tokens or push for staff, a fallback for lost devices.<\/li>\n<li>Confirm licensing, including the FortiGuard subscription for tokens.<\/li>\n<li>Fix time sync and the mail or SMS service.<\/li>\n<li>Pilot with IT first, then a small department.<\/li>\n<li>Document a recovery process for a lost phone, and who may approve it.<\/li>\n<li>Keep one tested emergency admin path.<\/li>\n<li>Re-test after every firmware upgrade.<\/li>\n<\/ul>\n<h2 id=\"faq\"><span class=\"ez-toc-section\" id=\"FAQ\"><\/span>FAQ<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3 id=\"how-do-i-enable-multi-factor-authentication-on-a-fortigate\"><span class=\"ez-toc-section\" id=\"How_do_I_enable_multi-factor_authentication_on_a_FortiGate\"><\/span>How do I enable multi-factor authentication on a FortiGate?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Register a FortiToken under User &amp; Authentication, then edit the user, enable Two-factor Authentication and pick the token. Add the user to a group used by your VPN or admin policy. For many users, use a RADIUS server instead and point the firewall at it.<\/p>\n<h3 id=\"can-i-use-email-for-two-factor-authentication-on-my-fortigate\"><span class=\"ez-toc-section\" id=\"Can_I_use_email_for_two-factor_authentication_on_my_FortiGate\"><\/span>Can I use email for two-factor authentication on my FortiGate?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Yes. Fortinet\u2019s token guide shows that you can enter a user\u2019s email address when you assign two-factor authentication, and that email service must be configured on the firewall first. Treat email as a fallback, since anyone who controls the inbox controls the code.<\/p>\n<h3 id=\"do-i-have-to-use-fortitoken\"><span class=\"ez-toc-section\" id=\"Do_I_have_to_use_FortiToken\"><\/span>Do I have to use FortiToken?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>No. FortiToken is the built-in option, but a RADIUS or SAML setup lets an outside authentication service handle the second factor. If you use FortiToken, the firewall needs a FortiGuard subscription.<\/p>\n<h3 id=\"is-single-sign-on-the-same-as-mfa-on-fortigate\"><span class=\"ez-toc-section\" id=\"Is_single_sign-on_the_same_as_MFA_on_FortiGate\"><\/span>Is single sign-on the same as MFA on FortiGate?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>No. SSO lets the firewall reuse an existing logon so users do not re-enter credentials. MFA requires an extra factor, and it applies only if your policy or authentication backend asks for one.<\/p>\n<h2 id=\"sources\"><span class=\"ez-toc-section\" id=\"Sources\"><\/span>Sources<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li><a href=\"https:\/\/www.fortinetguru.com\/2016\/06\/two-factor-authentication\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Two-factor authentication, Fortinet GURU<\/a><\/li>\n<li><a href=\"https:\/\/fortinetweb.s3.amazonaws.com\/docs.fortinet.com\/v2\/attachments\/a3e2887c-20eb-11e9-94bf-00505692583a\/FortiToken-5.4-Comprehensive_Guide.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">FortiToken 5.4 Comprehensive Guide, Fortinet<\/a><\/li>\n<li><a href=\"https:\/\/fortinetweb.s3.amazonaws.com\/docs.fortinet.com\/v2\/attachments\/502fabff-dbf1-11ea-96b9-00505692583a\/FortiAuthenticator-6.2.0-Cookbook.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">FortiAuthenticator 6.2.0 Cookbook, Fortinet<\/a><\/li>\n<li><a href=\"https:\/\/www.yumpu.com\/en\/document\/view\/7015690\/user-authentication-fortinet-technical-documentation\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">User Authentication, Fortinet Technical Documentation<\/a><\/li>\n<li><a href=\"https:\/\/infosecmonkey.com\/fortigate-authentication-settings-a-comprehensive-guide\/\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">FortiGate Authentication Settings: Config &amp; Methods, Infosec Monkey<\/a><\/li>\n<\/ul>\n<h2 id=\"recommended\"><span class=\"ez-toc-section\" id=\"Recommended\"><\/span>Recommended<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li><a href=\"https:\/\/support.logmeonce.com\/hc\/en-us\/articles\/115012663307-Two-Factor-Authentication-Setup\" target=\"_blank\" rel=\"noopener\">Two-Factor Authentication Setup<\/a><\/li>\n<\/ul>\n\n<div style=\"font-size: 0px; height: 0px; line-height: 0px; margin: 0; padding: 0; clear: both;\"><\/div>","protected":false},"excerpt":{"rendered":"<p>How to add multi-factor authentication to FortiGate VPN and admin logins: FortiToken, email and SMS, RADIUS, FortiAuthenticator, testing and fixes.<\/p>\n","protected":false},"author":0,"featured_media":248475,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-248473","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-logmeonce"],"acf":[],"_links":{"self":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts\/248473","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/comments?post=248473"}],"version-history":[{"count":1,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts\/248473\/revisions"}],"predecessor-version":[{"id":248474,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts\/248473\/revisions\/248474"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/media\/248475"}],"wp:attachment":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/media?parent=248473"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/categories?post=248473"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/tags?post=248473"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}