Duo Security 2FA with Fortigate Firewalls

Although Fortinet has a great 2FA solution (FortiToken) which is simple to use and does not require anything extra, there ARE customers out there that are currently using Duo Security (Now a Cisco Company). Duo is a solid 2FA solution. Here is the configuration. In my lab, I am using a Fortigate 300E running 6.0.3, Windows 2016 (Fake DC), Duo Security Account, CentOS 7 (minimum install), ESXi 6.7

Ensure you visit www.duo.com and set up an account. You will need to get the API Key, the iKey as well as the sKey. You will need to create a user and assign a token. The initialization of the token on my IOS device was kind of kludgy. Fortinet has a nicer and easier deployment method. I will create a separate blog post for FortiToken. I remember it being easier prior to the Cisco acquisition, but I may have missed something.

Deploying the VM

As you can see above, we are using CentOS Linux 7 (64 bit)

Ensure you add the ISO for CentOS to the CD ROM and ensure you have the ‘Connect’ button selected. Also move the NIC to the proper VLAN.

CentOS Setup

You should either use the local console or use the remote console (I opted for the remote console). Choose the language and keyboard and hit ‘continue’.

Select the disk you are going to install CentOS on.

Configure a hostname and IPv4/IPv6. NOTE: Click the button that says ‘off’ and set it to ‘on’.

Initial Configuration of CentOS

You can now ssh to the CentOS box. ‘ssh root@x.x.x.’, enter the root password you set in the previous step and hit enter.

Next you will want to install ‘net-tools’ which will give you the ability to run command like ‘ifconfig’

yum install net-tools

Choose ‘Y’ to authorize the install

yum install gcc make python-devel libffi-devel perl zlib-devel

Next you will install gcc (compiler), phyton and other necessary libraries.

To make it easier to download the proxy agent for Duo without having to SFTP etc to the box, you can install ‘wget‘

yum install wget

Also answer ‘Y‘

Check the status of the CentOS firewall but entering the following command:

sudo firewall-cmd --state

Output should say something like this:

running

To completely disable the CentOS firewall:

sudo systemctl stop firewalld
sudo systemctl mask --now firewalld

Installing the Duo Proxy Agent

Now you can create a directory to download the files to:

cd /opt
mkdir duo

Now change the working directory to the /opt/duo folder

Next you will need to download the duo proxy agent:

wget https://dl.duosecurity.com/duoauthproxy-latest-src.tgz

Now you will need to untar the package and prepare to install

tar xzf duoauthproxy-latest-src.tgz
cd duoauthproxy-version-src
make

NOTE: Once you run the ‘make’ command, it will take ~10 Minutes

Change the directory to the one created in the ‘untar’ option created above.

cd duoauthproxy-build

Microsoft AD Configuration

Ensure you have a ’Security Group’ and service account created. You should also create a some user(s) for testing.

 

You will need to edit the config file for the proxy agent.

vi /opt/duoauthproxy/conf/authproxy.cfg

You will need to run your cli editing tool. I use vi.

[ad_client]
host=10.1.106.43
service_account_username=duoadmin
service_account_password=FakePassword001
search_dn=DC=myinfoseclab,DC=local
security_group_dn=CN=duo-group,CN=Users,DC=myinfoseclab,DC=local

[radius_server_auto]
ikey=DI17<REMOVED>N
skey=DROHTJJ3Y<REMOVED>qMP
api_host=api-<REMOVED>.duosecurity.com
radius_ip_1=10.1.106.55
radius_secret_1=FakePassword001
client=ad_client
port=1812
failmode=safe

To start the proxy agent from the cli:

/opt/duoauthproxy/bin/authproxyctl start

You should see something like the screenshot above.

Configuring the Fortigate Firewall

Now on the Fortigate you will need to create a RADIUS Server object by browsing to ‘Users and Devices’ then ‘RADIUS Server‘

Create a Fortigate Group object.

Choose your AD Group from the ‘Remote Groups’ sections.

Make sure you add the ‘group’ you created in the previous step to the ‘SSL-VPN Settings’ as well as the ‘IPv4 Policies‘

You should now be able to use your Duo Security 2FA solution with the Fortigate.