When purchasing mobile tokens for Fortiauthenticator FGT or a partner will usually send a PDF with an activation code. The PDF has good instructions on how to register the code, but I thought I would show some images.
Open the PDF. On the top it will say something like “FortiToken TM Mobile Redemption Certificate”
It will also have an activation code – for example 34D8-xxxx-xxxx-xxxx-xxxx
Login into your Fortiauthenticator and navigate to
I had an issue, well more of a specific formatting issue with Fortiauthenticator that I thought I would share. I have a client who is only use SMS with forticlient via fortiauth. The idea is that the user connects and authenticates to the SSL VPN, and then hits Fortiauth for token code that was sent to the client VIA SMS.
When using SMS with tokens, you have to have the users mobile number entered so it can send to them. Hard coding the users mobile number worked great, but for some reason I could not get the remote sync rule to pull in the mobile phone number. Below are the steps I used to fix this.
First in the remote sync rule under “LDAP User Mapping Attributes” modify the mobile data field with “mobile” all lower case.
Then make sure that in Active Directory the mobile number is entered under the users profile. the Auth says it wants the mobile phone number in a very specific format – +[international_number] – this threw me for a while. In the end the number in AD wasn’t the problem it was the mapping attribute. Below is how to inset the number into AD. Notice the number has +[country code]number. Thats it, after putting that in the remote sync rule worked fine.
I am more impressed with Fortiswitches every time I work with them. The ability to implement light NAC features, INTRAvlan firewall policies and overall management really gives these switches a feature set to checkout when deciding on new switches.
Below are the steps to quickly get the interface stats such as errors/packets, etc. The commands are ran on the Fortigate, which in this case is controlling the Fortiswitch.
Drop into CLI on the FGT and check what switches are connected by running the command
get switch-controller managed-switch
This command will bring back the names of the manged switches. Locate the switch you want to check the port stats on. For example, we will use the name “FS1D24T419001174”
the command to get the stats are:
diag switch-controller switch-info port-stats FS1D24T419001174 port1
The output is in the image below:
using the top level command diag switch-controller switch-info you can also get LLDP, Power, and lots more info of the managed switch.
This entry shows how I have been setting up ICX switches with Fortinac.
In this scenario my Fortinac is located at 192.168.226.248, the switch is 192.168.226.53, and my SNMP community is “snmp”. I know very secure. The switch I am working with is a Ruckus 7250 running SPR08092a.bin
These are the settings that I am putting into my switch:
logging host 192.168.226.248
snmp-server host 192.168.226.248 version v2c snmp
snmp-server enable traps mac-notification
snmp-server enable traps link-up
snmp-server enable traps link-down
On the NAC we have to add the switch, and make sure we have a CLI user account, and SNMP creds that work. We can test this within NAC to make sure things are up and going.
After we add the device, we can validate the settings
After the device has been added you should see your interfaces/devices/status all show up.
When you setup Fortinac you have to license it, and Fortinet asks you what the MAC and UUID of the device are when registering the license. You can get this information by SSH’ing into the NAC and running the following commands:
sysinfo -v | grep -i UU — This will bring back the UUID
and to get the mac – run ifconfig eth0
Copy those two settings into the registration of the license, and you can then get the license key.
Had a strange issue the other day with a FAC, where it would not send emails to users with their assigned tokens, but would send emails just fine any other time. I wanted to capture all outgoing traffic to see if SMTP messages were really being sent.
Fortiauth has Tcpdump built in, and is very easy to run.
First SSH into the FAC, from there you have some execute options. Below shows the tcpdump options:
exe tcpdump?
tcpdump Examine local network traffic.
tcpdumpfile Same as tcpdump, but write output to a file downloadable via GUI.
exe tcpdump
If you run ‘exe tcpdump’ it will spit all the traffic to the screen, but if you run ‘exe tcpdumpfile’ it will log the output to a .pcap that is downloadable from the GUI. This gives you the option to open it in Wireshark and analyze.
To download the .pcap open your Fortiauth append /debug to the web address for example: https://10.110.2.60/debug. From here you will be prompted with what you want to debug, and at the bottom is the option to open the “CLI Packet Capture” this gives you the option to download the pcap.
Thats it! Thank you Fortinet.
Recent Comments