Fortigate MFA for admin accounts

General Overview

This guide explains how to perform multiple authentication for administrator accounts in Fortigate Firewall.

Configuring the Fortigate Firewall

Administrator Configuration

For multifactor authentication with administrator in FortiGate Firewall, you need to add an administrator account.

To configure an administrator account:

Access the FortiGate web UI using https://<IP address of FortiGate>
Select System > Administrators.
Click on Create New > Administrator
Enter a username for the Administrator account in the Name field.
Under the Type section, select "Match a user on a remote server group' for a single user", or "Match all users in a remote server group" for all users. We proceed by choosing the "Match a user on a remote server group" option.
Enter a backup password in the Backup Password field, for use when Fortigate is unable to reach the credential server.
Enter your backup password in the Confirm Password field.
Select "super_admin" option from Administrator Profile dropdown list.
Select the remote user group to which you will add the administrator account from the Remote User Group dropdown list.
Keep the remaining settings as default values.

Click on OK to confirm settings.

Configure Mirket

To enable Mirket to receive authentication requests from FortiClient, follow these steps:

Add Fortigate as a Resource in Mirket with Radius Gateway

Before starting, ensure that you have installed Mirket Radius Gateway from the Configuration > Gateway. To add a Radius Gateway to the Mirket, follow these steps:

Go to Configuration > Gateway and click on the Add Radius Gateway button.
On the displayed screen, enter a name for your Radius Gateway in the Name field.
Enter the SAM value of the gateway in the Sam Value field. In Mirket, user identification is done using the SAM (Security Account Manager) name. This is preferred over the standard username. This username is used for authentication and access controls.
Enter the IP address of the server where the gateway is installed in the Host IP Address field.
Enter the authentication port value you set for the gateway in the Auth Port field. The default value is 1812.
Enter the accounting port value you specified for the gateway in the Acc Port field. The default value is 1813. Note: After completing these fields, you must create a RADIUS client for the newly created RADIUS Gateway.
Click on the Add Radius Client option at the bottom of the displayed screen.
Enter a name for your Radius Client in the Radius Client field.
Enter the IP address of the client(firewall) that will communicate with the gateway in the IP Address field.
Enter the secret key that the client will communicate with the gateway in the Secret Key field.

Click on the Save button to confirm the settings.

Configuring Radius Gateway

After creating the Radius Gateway, click on the Download > Config from the menu on the right side of the gateway.

This option will generate a script related to the gateway, which will be displayed from the RADIUS Setup config file. The config file will automatically begin downloading once this option is selected.

Replace the existing config file in the "C:\MirketRadius" directory with the downloaded file. Alternatively, copy the displayed script and paste it into the config file in "C:\MirketRadius".

Then, restart the Mirket Radius Service.

You can check whether the Radius Gateway you created is active by navigating to Configuration > Gateway.

User and Group configuration on Mirket

To set up multifactor authentication, make sure you have at least one user or group in Mirket.

If it is preferred to use a local user, you can first create a local group and then create a local user and make the user a member of the group. Alternatively, you can create a local user without creating a local group.

Add a Radius Rule to Mirket

Radius Rules define user access to resources and the authentication methods available (such as SMS, Approve / Deny, OTP, etc.).

First, you should follow these steps:

Go to Configuration > Radius Rules.
Click on the Add Radius Rule button.
On the displayed screen, enter a name for the rule in the Name field.
Enter the rule description in the Description field.
Select the Radius Client to which the rule will apply from the Radius Client dropdown list.
Enter the source IP addresses to which the rule will apply in the Source Adress field.
Select the source countries where the rule will be applied from the Source Country dropdown list.
Click on the Next button.

Specify whether the rule will be applied to a user or a group.
After specifying, click on the Next button.

Select the users or groups to which the rule will apply. Transfer your selections to the Selected Users/Groups table by clicking the arrow icon next to the Available Users/Groups table.
Click on the Next button.

Select the time period when the rule will run.
- All: The rule will run every day.
- Recurring: The rule will run on the specified days and times.
- One Time: The rule will run within the date range you specify.
After selecting, click on the Next button.

Specify whether the user or group will be granted access based on the rule in the Action field.
Select the authentication provider to which the rule will apply from the Auth Method dropdown list.
Select the attribute type as "FortigateGroupName" from the Attribute Type dropdown list.
Enter the group to be granted authorization in the Value field. Please make sure that the value is the same as the group name you specify in Fortigate.

Click on Save to confirm the settings.

Last updated 2 months ago