FortiGate 2-Factor Authentication via SMS

Two-factor authentication is quite common these days. That’s good. Many service providers offer a second authentication before entering their systems. Beside hardware tokens or code generator apps, the traditional SMS on a mobile phone can be used for the second factor.

The FortiGate firewalls from Fortinet have the SMS option built-in. No feature license is required for that. Great. The only thing needed is an email-to-SMS provider for sending the text messages. The configuration process on the FortiGate is quite simple, however, both the GUI as well as the CLI are needed for that job. (Oh Fortinet, why aren’t you improving your GUI?)

Here is a step-by-step configuration tutorial for the two-factor authentication via SMS from a FortiGate firewall. My test case was the web-based SSL VPN portal.

The second factor is sent via SMS. More precisely: via email2sms. That is: The FortiGate sends an email to <phone-number>@email2sms-provider.tld with the authentication code. In order to use this feature, an email server as well as an SMS service must be configured. I am not using the “FortiGuard Messaging Service” for this test but a “Custom” Email-2-SMS service from the Internet (just found via Google).

I am using a FortiWiFi 90D with FortiOS 5.2.4, build688.

Email Service

The SMTP server should be configured anyway in order to receive alert emails from the FortiGate. If it is not configured yet, it is done under System -> Config -> Advanced -> Email Service:

FortiGate SMS 01 Email Service

SMS Service

The SMS service settings are directly below the email service. Only a name and the “Domain” must be entered. This was a bit confusing for me as I saw it the first time since no other options can be set. But in fact, the FortiGate will send all SMS to <number@domain>. So it really does not need any more information. The correct domain for the mail2sms gateway is listed on the service you chose on the Internet. (I am using websms.com, a German provider.)

FortiGate SMS 02 SMS Service

User

The most annoying point is to activate the two-factor SMS authentication for the user since it cannot be done through the GUI. Furthermore, if you add users, the GUI from FortiGate is not consistent in storing the phone number for local users. (As with almost all cases, the GUI from Fortinet is not that good.) So take care!

The phone number can be entered via the GUI, as well as the “Custom” SMS provider, but the only option for the “Enable Two-factor Authentication” is the Token, which we won’t use here:

Use the CLI in order to configure the following command for each user (line 3):

After that, the two factor auth method “sms” is shown in the summary as well as under the users details:

That’s all for the config.

Test

My use case for the two-factor authentication is the web-based SSL VPN. Following are the screenshots I’ve made during the logon process, as well as the log events:

The corresponding log messages on the CLI look like this:

I like it. Easy to use, even for non-technical persons. ;)

[Update] SMS Expiry

After I implemented this feature by some customers I got some tickets in which users were complaining about login failures. I figured out that these failures were related to the short SMS expiry of 60 seconds. Since the token path via email and SMS takes some time, I recommend to increase the expiry to 120 seconds:

Works better now.

Links

2 thoughts on “FortiGate 2-Factor Authentication via SMS

  1. Good guide, thank you. However Fortigate makes sender address the same as recipient and this causes a problem. Emails sent to number@domain appeared from the same number@domain. This triggers anti spoofing policy on our antispam filter and I had to create the policy to bypass it. Another issue was the SMS provider (I tried 2 different and the issue was the same) had to have number@domain added in their allowed email addresses for this to work.

Leave a Reply

Your email address will not be published. Required fields are marked *