Getting started
The FortiAuthenticator device is an identity and access management solution that provides user identity services to Fortinet products and third-party devices.
It offers a range of features designed to secure your network infrastructure including authentication, MFA, IEEE 802.1X support, user authentication, and certificate management.
FortiAuthenticator is a critical system and should be isolated on a network interface separate from other hosts to enhance server-related firewall protection and prevent unauthorized access.
FortiAuthenticator can also replace the Fortinet Single Sign-On (FSSO) Agent on a Windows AD network.
Planning
Before deploying your standalone FortiAuthenticator, review the following key areas:
Requirements
Ensure the following prerequisites are met for a successful FortiAuthenticator setup:
|
Requirement |
Description |
|||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Supported Environments |
FortiAuthenticator 8.0 supports virtualization environments such as:
|
|||||||||||
|
Browser Support |
For supported versions, see Web browser support in the latest FortiAuthenticator Release Notes. |
|||||||||||
|
VM Resources |
Minimum 16 GB RAM required. |
|||||||||||
|
Administrative Access |
You must have administrative access to both the GUI and/or CLI. |
|||||||||||
|
Initial System Configuration |
Essential settings like system time, DNS settings, administrator password, and network interfaces must be configured. Network Time Protocol (NTP) is crucial for maintaining accurate and stable time, especially when using Time-based One-time Password (TOTP) for two-factor authentication |
|||||||||||
|
Third-Party Components |
Any third-party software or servers intended for use with FortiAuthenticator should be configured according to their respective documentation. |
|||||||||||
|
Open Ports |
Ensure that specific ports are open in security policies between the FortiAuthenticator and authentication clients, in addition to management protocols (
|
Licensing
FortiAuthenticator-VM operates in evaluation mode until a license is applied, which limits the number of configurable users.
-
A stackable license can be applied to increase user count and other associated metrics.
-
For the license to be valid, one of the FortiAuthenticator interfaces must be set to the IP address specified in the license.
-
Licenses for FortiAuthenticator-VM apply to:
-
The total number of local and remote user accounts configured.
-
The number of concurrent FSSO sessions.
-
Maximum limits on all other configuration objects are derived as a ratio to the maximum user count.
-
-
SSO Mobility Agent (SSOMA) client limits are determined by the lowest of either "Maximum FortiClient SSO" or "Maximum users" from the onboard license.
-
SSOMA, FTM (FortiToken Mobile), and SMS licenses are purchased separately and do not scale with the FortiAuthenticator user limit.
For High Availability (HA) clusters:
-
Primary HA clusters require each FortiAuthenticator unit to have its own license of the same size (users and SSOMA clients).
-
An HA load-balancer needs a user license size sufficient to replicate the configuration from the primary, though the SSOMA license size can differ based on which node SSOMA clients connect to.
FortiAuthenticator-VM accepts subscription based license.
See Subscription VM license in the latest FortiAuthenticator Administration Guide.