Integrations · FortiGate
FortiGate 2FA: phone approval for VPN and administrator logins
For organisations with an internet-facing FortiGate whose VPN or administration console still accepts a password alone. With the Notakey auth-proxy in the RADIUS path, a leaked, sprayed or cracked password becomes a failed attempt instead of a login.
How it connects
Standard RADIUS, with the approval added in the middle
A FortiGate can send VPN and administrator logins to a RADIUS server. The Notakey auth-proxy sits in that RADIUS path: it lets your existing RADIUS server check the password, then asks the user to approve on their phone, and only answers yes when both succeed.
Your RADIUS server and the users in it stay unchanged. The FortiGate talks to the proxy over standard RADIUS, like any other VPN concentrator. If you do not run a RADIUS server, the RADIUS plugin that ships with the Notakey appliance can be the downstream server.
FortiGate also supports remote authentication for administrators against RADIUS, including a wildcard admin account for everyone in a RADIUS group. That puts the approval in front of the console attackers go after, not only in front of the VPN.
What to know before you start
- We have not lab-tested a FortiGate ourselves. The FortiGate settings come from Fortinet’s documentation, linked from the guide; the FortiGate talks to the auth-proxy over standard RADIUS.
- By default FortiGate gives the whole RADIUS exchange 5 seconds (remoteauthtimeout) and resends after 5 seconds. Both must be comfortably longer than the proxy’s 30-second window. The proxy ignores a resent request so the user does not get a second approval, but making the resend timeout the longer of the two keeps the exchange to a single request.
- A phone approval does not fix a device that is already compromised: accounts the attackers created, sessions they hold or configuration they changed. Terminate sessions, reset passwords and review the configuration first.
- A second factor on a management interface that should not be reachable from the internet is the weaker fix. Restrict administration with trusted hosts, a local-in policy, or no internet administration at all.
- A phone approval does not, on its own, stop an attacker who relays a real login through a fake page in real time. For the handful of accounts that administer the firewall itself, site-bound keys such as FIDO are worth considering.
- Keep a local emergency administrator with a long unique password, reachable only from trusted hosts, and test it before you need it.
From zero to the first approval
- 01
Create the application and configure the auth-proxy
Create a VPN application in the Notakey dashboard, onboard the users’ phones and copy the Access ID. Configure the auth-proxy on the appliance (or as a container next to your RADIUS server) with that Access ID, the downstream RADIUS address and the shared secrets.
- 02
Point the FortiGate at the proxy and raise the timeouts
Add the proxy as the FortiGate’s RADIUS server with the same secret. Raise remoteauthtimeout and the RADIUS server timeout well above the proxy’s 30-second approval window, for example 60 seconds overall and 90 before a resend.
- 03
Test with a second session open
Log in to the VPN with a RADIUS user and approve the push, then try once more and deny. Confirm your local emergency administrator still gets in before you close the working session.
Frequently asked questions
- Does FortiGate need a Fortinet plugin for Notakey?
- No. The FortiGate sends VPN and administrator logins to the Notakey auth-proxy over standard RADIUS, like any other VPN concentrator, so no Fortinet-specific plugin is needed. The FortiGate settings come from Fortinet’s documentation; we have not lab-tested a FortiGate ourselves.
- Which FortiGate timeouts have to change?
- FortiGate’s remoteauthtimeout gives the whole RADIUS exchange 5 seconds by default, and it resends after 5 seconds. Raise both well above the proxy’s 30-second approval window, for example 60 seconds overall and 90 before a resend.
- Can the phone approval also protect administrator logins?
- Yes. FortiGate supports remote authentication for administrators against RADIUS, including a wildcard admin account for a RADIUS group, so the console gets the same approval. Keep a local emergency administrator reachable only from trusted hosts.