FortiGate 2-Factor Authentication via SMS

Two-factor authentication is quite common these days. That’s good. Many service providers offer a second authentication before entering their systems. Beside hardware tokens or code generator apps, the traditional SMS on a mobile phone can be used for the second factor.
The FortiGate firewalls from Fortinet have the SMS option built-in. No feature license is required for that. Great. The only thing needed is an email-to-SMS provider for sending the text messages. The configuration process on the FortiGate is quite simple, however, both the GUI as well as the CLI are needed for that job. (Oh Fortinet, why aren’t you improving your GUI?)
Here is a step-by-step configuration tutorial for the two-factor authentication via SMS from a FortiGate firewall. My test case was the web-based SSL VPN portal.

The second factor is sent via SMS. More precisely: via email2sms. That is: The FortiGate sends an email to <phone-number>@email2sms-provider.tld with the authentication code. In order to use this feature, an email server as well as an SMS service must be configured. I am not using the “FortiGuard Messaging Service” for this test but a “Custom” Email-2-SMS service from the Internet (just found via Google).
I am using a FortiWiFi 90D with FortiOS 5.2.4, build688.

Email Service

The SMTP server should be configured anyway in order to receive alert emails from the FortiGate. If it is not configured yet, it is done under System -> Config -> Advanced -> Email Service:

SMS Service

The SMS service settings are directly below the email service. Only a name and the “Domain” must be entered. This was a bit confusing for me as I saw it the first time since no other options can be set. But in fact, the FortiGate will send all SMS to <number@domain>. So it really does not need any more information. The correct domain for the mail2sms gateway is listed on the service you chose on the Internet. (I am using websms.com, a German provider.)

User

The most annoying point is to activate the two-factor SMS authentication for the user since it cannot be done through the GUI. Furthermore, if you add users, the GUI from FortiGate is not consistent in storing the phone number for local users. (As with almost all cases, the GUI from Fortinet is not that good.) So take care!
The phone number can be entered via the GUI, as well as the “Custom” SMS provider, but the only option for the “Enable Two-factor Authentication” is the Token, which we won’t use here:

Use the CLI in order to configure the following command for each user (line 3):

1 2 3 4

fd-wv-fw04 # config user local fd-wv-fw04 (local) # edit weberjoh2 fd-wv-fw04 (weberjoh2) # set two-factor sms fd-wv-fw04 (weberjoh2) # next

After that, the two factor auth method “sms” is shown in the summary as well as under the users details:

That’s all for the config.

Test

My use case for the two-factor authentication is the web-based SSL VPN. Following are the screenshots I’ve made during the logon process, as well as the log events:

The corresponding log messages on the CLI look like this:

1 2 3

23: date=2015-12-03 time=17:23:16 logid=0100038411 type=event subtype=system level=notice vd="root" logdesc="Two-factor authentication code sent" user="weberjoh2" action="send authentication code" msg="Send two-factor authentication token code 047548 to 004********211@email2sms.websms.com" 24: date=2015-12-03 time=17:23:16 logid=0101039943 type=event subtype=vpn level=information vd="root" logdesc="SSL VPN new connection" action="ssl-new-con" tunneltype="ssl" tunnelid=0 remip=87.159.185.106 tunnelip=(null) user="N/A" group="N/A" dst_host="N/A" reason="N/A" msg="SSL new connection"

I like it. Easy to use, even for non-technical persons. ;)

[Update] SMS Expiry

After I implemented this feature by some customers I got some tickets in which users were complaining about login failures. I figured out that these failures were related to the short SMS expiry of 60 seconds. Since the token path via email and SMS takes some time, I recommend to increase the expiry to 120 seconds:

1 2 3

config system global     set two-factor-sms-expiry 120 end

Works better now.

Links

• Fortinet: Technical Note: SMS Two Factor Authentication in FortiGate
• Wikipedia: Two-factor authentication