Although Fortinet has a great 2FA solution (FortiToken) which is simple to use and does not require anything extra, there ARE customers out there that are currently using Duo Security (Now a Cisco Company). Duo is a solid 2FA solution. Here is the configuration. In my lab, I am using a Fortigate 300E running 6.0.3, Windows 2016 (Fake DC), Duo Security Account, CentOS 7 (minimum install), ESXi 6.7
Ensure you visit www.duo.com and set up an account. You will need to get the API Key, the iKey as well as the sKey. You will need to create a user and assign a token. The initialization of the token on my IOS device was kind of kludgy. Fortinet has a nicer and easier deployment method. I will create a separate blog post for FortiToken. I remember it being easier prior to the Cisco acquisition, but I may have missed something.
Deploying the VM
As you can see above, we are using CentOS Linux 7 (64 bit)
Ensure you add the ISO for CentOS to the CD ROM and ensure you have the ‘Connect’ button selected. Also move the NIC to the proper VLAN.
CentOS Setup
You should either use the local console or use the remote console (I opted for the remote console). Choose the language and keyboard and hit ‘continue’.
Select the disk you are going to install CentOS on.
Configure a hostname and IPv4/IPv6. NOTE: Click the button that says ‘off’ and set it to ‘on’.
Initial Configuration of CentOS
You can now ssh to the CentOS box. ‘ssh root@x.x.x.’, enter the root password you set in the previous step and hit enter.
Next you will want to install ‘net-tools’ which will give you the ability to run command like ‘ifconfig’
yum install net-tools
Choose ‘Y’ to authorize the install
yum install gcc make python-devel libffi-devel perl zlib-devel
Next you will install gcc (compiler), phyton and other necessary libraries.
To make it easier to download the proxy agent for Duo without having to SFTP etc to the box, you can install ‘wget‘
yum install wget
Also answer ‘Y‘
Check the status of the CentOS firewall but entering the following command:
sudo firewall-cmd --state
Output should say something like this:
running
To completely disable the CentOS firewall:
sudo systemctl stop firewalld
sudo systemctl mask --now firewalld
Installing the Duo Proxy Agent
Now you can create a directory to download the files to:
cd /opt
mkdir duo
Now change the working directory to the /opt/duo folder
Next you will need to download the duo proxy agent:
wget https://dl.duosecurity.com/duoauthproxy-latest-src.tgz
Now you will need to untar the package and prepare to install
tar xzf duoauthproxy-latest-src.tgz
cd duoauthproxy-version-src
make
NOTE: Once you run the ‘make’ command, it will take ~10 Minutes
Change the directory to the one created in the ‘untar’ option created above.
cd duoauthproxy-build
Microsoft AD Configuration
Ensure you have a ’Security Group’ and service account created. You should also create a some user(s) for testing.
You will need to edit the config file for the proxy agent.
vi /opt/duoauthproxy/conf/authproxy.cfg
You will need to run your cli editing tool. I use vi.
[ad_client] host=10.1.106.43 service_account_username=duoadmin service_account_password=FakePassword001 search_dn=DC=myinfoseclab,DC=local security_group_dn=CN=duo-group,CN=Users,DC=myinfoseclab,DC=local [radius_server_auto] ikey=DI17<REMOVED>N skey=DROHTJJ3Y<REMOVED>qMP api_host=api-<REMOVED>.duosecurity.com radius_ip_1=10.1.106.55 radius_secret_1=FakePassword001 client=ad_client port=1812 failmode=safe
To start the proxy agent from the cli:
/opt/duoauthproxy/bin/authproxyctl start
You should see something like the screenshot above.
Configuring the Fortigate Firewall
Now on the Fortigate you will need to create a RADIUS Server object by browsing to ‘Users and Devices’ then ‘RADIUS Server‘
Create a Fortigate Group object.
Choose your AD Group from the ‘Remote Groups’ sections.
Make sure you add the ‘group’ you created in the previous step to the ‘SSL-VPN Settings’ as well as the ‘IPv4 Policies‘
You should now be able to use your Duo Security 2FA solution with the Fortigate.
