2FA SSL VPN with LDAP authentication

[Navs1818]

Hi all, i have a HA (active passive) pair of 100E fortigate firewalls and want to enable 2FA for SSL VPN.

Current Setup

We use LDAP auth, with any users in a specific AD group allowed to VPN in, saves us having to create individual users on the firewall.

2FA Setup

Two me it appears i can use either Fortitokens or a Certificate for 2FA, but from reading and testing it appears that for both methods i need to create local users mapped to LDAP users on the firewall. Then i can either apply a token or a cert to each user (LDAP or PKI), is my understanding correct?

Is there any way to enable 2FA without the need to create individual users on the firewall?

Thanks

[sw2090]

afair the Fortigates do support radius usergroups so you don't need to create the users here. Alas in this case the 2FA has to be done by the radius. We do it this way with IPSec VPN using a FortiAuthenticator for radius auth on it using radius usergroups from the FAC which are filled with users the FAC imports from AD Usergroups. FAC also provides FortiTokens as 2FA here.

[Navs1818]

Unfortunately, we don't use a FAC. I assume there is no way to sync LDAP users belonging to a specific AD group into the fortigate itself?

[sw2090]

hm I assume that then you will need to use the FGT's AD Connector for authenticating against AD. 2FA then might force you to create radius users on the FGT to be able to add a cert or token to the user.

[hbac]

Hi @Navs1818,

Yes, you need to create each local user otherwise, you won't be able to assign FortiToken to each user. You can consider using SAML or DUO MFA.

Regards, 

[Navs1818]

Looks like the other option is to use Forticloud tokens, you can sync users in a particular AD group into forticloud and it will then assign a token, but it has an annual cost.