Set up Nexus OTP as 2FA for Fortinet Firewall

Network schematic with Nexus TruID Synchronized as an example.

1. The end user starts the TruID client and enters the PIN in TruID to generate an OTP.
2. Fortinet Firewall request the end user to enter username, password and OTP.
3. The end user enters username, domain password and OTP.
4. The domain credentials are validated by the Active Directory.
5. The OTP authentication request is relayed to Digital Access Authentication Server via RADIUS.
6. The authentication server validates the OTP with the associated TruID token and PIN from the user database.
7. Upon successful validation, the authentication server responds with successful authentication to Fortinet Firewall.

Fortinet Firewall provides access to the end user.

• Deployed Digital Access, see Deploy Digital Access component
• Installed Fortinet Firewall, see https://www.fortinet.com/products/next-generation-firewall.html

1. Log in to Digital Access Admin with an administrator account.

In step 3, enter the IP Address of the RADIUS Client (Fortinet Firewall) and the Shared Secret Key.

1. In Digital Access Admin, go to Manage System.

2. Click RADIUS Configuration > Add RADIUS Client...

3. Enter General Settings and Attributes. Click the ?-sign for help.

4. Click Save.

Nexus TruID Synchronized is used as an example. Other Nexus OTP authentication methods are enabled in a similar way.

• In step 3, select Nexus Synchronized as method.
• When the default RADIUS replies are shown, click Next. You can also add your custom RADIUS replies or modify the default replies if required.

To add a new authentication method:

1. In Digital Access Admin, go to Manage System.
   
2. Click Authentication Methods.

3. Click Add authentication method..., select the desired method and click Next.

4. Enter Display Name, a unique name used in the system to identify the authentication method.
5. Select if the method shall be enabled and if it shall be visible in authentication menu.
   
6. Register Authentication Methods Server when applicable.
   
7. Make other configurations as needed for the selected authentication method. For more information , click the ?-sign. Click Next.
8. If needed, make settings in RADIUS Replies and Extended Properties.
9. Click Next and Finish.
10. Click Publish.
    

1. Log in to the Fortinet Firewall administrative console.

2. Expand the User & Device section.

3. Expand Authentication and select RADIUS Server.

4. Click Create New to create a new profile.

   

5. Enter the RADIUS server details and click OK.
   

   

6. If required, can change the default RADIUS port via the command line.

   CODE

   > config user radius
   > edit portwise
   > set radius-port 18124
   > end

7. Create a user and assign the RADIUS authentication.

   

1. On a workstation with FortiClient VPN client installed, launch the application and enter the IP address or DNS name of the Fortinet Firewall.

2. Click Apply.
   

   

3. Start Nexus TruID that is installed on your laptop or smartphone - Enter PIN to Generate an OTP.

4. Select the Connection Profile, enter your Nexus user name, OTP and click Connect.
   

   

1. On a workstation with FortiClient VPN client installed, launch the application and enter the IP address or DNS name of the Fortinet Firewall.

2. Click Apply.
   

   

3. Select the Connection Profile, enter your AD credentials and click Connect.

4. FortiClient will prompt for OTP.

5. Check your registered mobile or email to get your OTP and enter the OTP in the FortiClient.