Fortigate MFA for admin accounts
General Overview
This guide explains how to perform multiple authentication for administrator accounts in Fortigate Firewall.
Configuring the Fortigate Firewall
Administrator Configuration
For multifactor authentication with administrator in FortiGate Firewall, you need to add an administrator account.
To configure an administrator account:
Access the FortiGate web UI using https://<IP address of FortiGate>
Select System > Administrators.
Click on Create New > Administrator
Enter a username for the Administrator account in the Name field.
Under the Type section, select "Match a user on a remote server group' for a single user", or "Match all users in a remote server group" for all users. We proceed by choosing the "Match a user on a remote server group" option.
Enter a backup password in the Backup Password field, for use when Fortigate is unable to reach the credential server.
Enter your backup password in the Confirm Password field.
Select "super_admin" option from Administrator Profile dropdown list.
Select the remote user group to which you will add the administrator account from the Remote User Group dropdown list.
Keep the remaining settings as default values.
Click on OK to confirm settings.
Add a Fortigate as Resource in Mirket with Mirket Radius Gateway
Before starting, ensure that you have installed Mirket Radius Gateway. To add a Radius Client to the Mirket Radius Gateway, follow these steps:
First, navigate to the directory
C:\MirketRadiusand open theconfig.jsonfile.
Fill in the gateway and radiusClientList fields according to the provided specifications to ensure accurate and secure network configuration.
samName: Enter the SAM name of the gateway. In Mirket, user identification is done using the SAM (Security Account Manager) name. This is preferred over the standard username. This username is used for authentication and access controls. Please provide your domain name, such as 'mirket'.
authenticationPort: Enter the authentication port value you set for the gateway. The default value is 1812.
accountingPort: Enter the accounting port value you specified for the gateway. The default value is 1813.
gatewayIp: Enter the IP address of the server where the Mirket is installed.
ipAddress: Enter the IP address of your firewall.
secretKey: Enter your secret key. This secret key is used to link your radius client and radius server, so ensure they are identical.
Once you've made the necessary changes to the config.json file, save and close it. Note: You can add multiple RADIUS clients.
After completing the configuration, restart the 'Mirket Radius Gateway Service'.
User and Group configuration on Mirket
To set up multifactor authentication, make sure you have at least one user group in Mirket.
If it is preferred to use a local user, first create a local group and then create a local user and make the user a member of the group.
If it is preferred to use LDAP users, the priority LDAP group is created by pulling users from Active Directory or OpenLDAP in Mirket.
Create an Authorization Profile on Mirket
After authentication, in scenarios requiring authorization (Example: Sending group name to the Radius client in SSL VPN), you can complete the process by creating an authorization profile in Mirket and selecting the created profile in Radius rules.
The following steps should be followed to create an authorization profile:
Select Authorization Profiles.
Click on Add New.
Enter a authorization profile name in the Name field.
Select the attribute type as "FortigateGrupName" from the Attribute Type dropdown list.
Enter the group to be granted authorization in the Value field. Please make sure that value is the same with grup name you spesify in Fortigate.
Click on Save to confirm settings.
Add a Radius Rules to Mirket
Radius Rules define user access to resources and the authentication methods available (such as SMS, Approve / Deny, OTP etc.).
First, you should follow these steps:
Select Rules > Radius Rules.
Click on Add New.
Enter a rule name in the Name field.
Enter the rule description in the Description field.
Select the group to which the rule applies from the Group dropdown list.
Select the provider to which the rule applies from the Provider dropdown list.
Select the authorization profile to which the rule applies from the Authorization dropdown list.
Click on Save to confirm settings.
Last updated
