FortiGate / FortiOS

FortiManager

FortiAnalyzer

Administration Guide

Getting started
- Summary of steps
- Using the GUI
- Using the CLI
- Configuration and management
- Product registration with FortiCare
- FortiGate models
- FortiTelemetry
  - Configuring a FortiTelemetry Controller
- FortiData NEW
  - Connecting FortiData to FortiGate
Dashboards and Monitors
- Using dashboards
- Using widgets
- Viewing device dashboards in the Security Fabric
- Creating a fabric system and license dashboard
- Dashboards
- Monitors
Network
- Interfaces
  - Interface settings
  - Physical interface
  - VLAN
  - Aggregation and redundancy
  - Loopback interface
  - Software switch
  - Hardware switch
  - Zone
  - Virtual wire pair
    - PRP handling in NAT mode with virtual wire pair
    - Using VLAN sub-interfaces in virtual wire pairs
  - Enhanced MAC VLAN
  - VXLAN
- DNS
  - Important DNS CLI commands
  - DNS domain list
  - FortiGate DNS server
  - DDNS
  - DNS latency information
  - DNS over TLS and HTTPS
  - Transparent conditional DNS forwarder
  - Interfaces in non-management VDOMs as the source IP address of the DNS conditional forwarding server
  - DNS session helpers
  - DNS troubleshooting
- Explicit and transparent proxies
  - Explicit web proxy
  - FTP proxy
  - Transparent proxy
  - Proxy policy addresses
  - Proxy policy security profiles
  - Explicit proxy authentication
  - Transparent web proxy forwarding
  - Transparent web proxy forwarding over IPv6
  - Upstream proxy authentication in transparent proxy mode
  - Multiple dynamic header count
  - Restricted SaaS access
  - Explicit proxy and FortiGate Cloud Sandbox
  - Proxy chaining
  - WAN optimization SSL proxy chaining
  - Agentless NTLM authentication for web proxy
  - Multiple LDAP servers in Kerberos keytabs and agentless NTLM domain controllers
  - Learn client IP addresses
  - Explicit proxy authentication over HTTPS
  - mTLS client certificate authentication
  - CORS protocol in explicit web proxy when using session-based, cookie-enabled, and captive portal-enabled SAML authentication
  - Display CORS content in an explicit proxy environment
  - HTTP connection coalescing and concurrent multiplexing for explicit proxy
  - Secure explicit proxy
  - Secure explicit proxy with client certificates
  - Explicit proxy logging
  - Configuring fast fallback for explicit proxy
  - Forward HTTPS requests to a web server without the need for an HTTP CONNECT message
  - Specifying outgoing interface and VRF for a web proxy forward server or isolator server
  - Isolator servers in proxy policies
- IPAM
  - IPAM introduction
  - Advanced configurations
  - Configuration examples
  - Diagnostics
- DHCP servers and relays
  - Basic configuration
  - DHCP options
  - DHCP addressing mode on an interface
  - VCI pattern matching for DHCP assignment
  - DHCP shared subnet
  - Multiple DHCP relay servers
  - DHCP smart relay on interfaces with a secondary IP
  - FortiGate DHCP works with DDNS to allow FQDN connectivity to leased IP addresses
- Static routing
  - Routing concepts
  - Policy routes
  - Equal cost multi-path
  - Dual internet connections
- Dynamic routing
  - RIP
    - Basic RIP example
    - Basic RIPng example
  - OSPF
  - BGP
  - BFD
    - BFD for multihop path for BGP
  - Routing objects
- Multicast
  - Multicast routing and PIM support
  - Configuring multicast forwarding
  - Using IPS inspection for multicast UDP traffic
  - Including denied multicast sessions in the session table
- FortiExtender
  - Adding a FortiExtender
- LTE modems
  - Automatic LTE connection establishment
  - Direct IP support for LTE/4G
  - Cellular interface support for IPv6
  - Active SIM card switching
  - Airplane mode and LTE/BLE
  - Upgrade LTE modem firmware directly from FortiGuard
- LLDP reception
- Virtual routing and forwarding
  - Implementing VRF
  - VRF routing support
  - Route leaking between VRFs with BGP
  - Route leaking between multiple VRFs
  - VRF with IPv6
  - IBGP and EBGP support in VRF
  - Support cross-VRF local-in and local-out traffic for local services
  - Support specific VRF ID for local-out traffic
- NetFlow
  - NetFlow templates
  - NetFlow on FortiExtender and tunnel interfaces
  - Allow multiple NetFlow collectors
  - Netflow sampling
  - Filter NetFlow sampling
- sFlow
- Link monitor
  - Link monitor with route updates
  - Enable or disable updating policy routes when link health monitor fails
  - Add weight setting on each link health monitor server
  - SLA link monitoring for dynamic IPsec and SSL VPN tunnels
- IPv6
  - IPv6 overview
  - IPv6 quick start
  - Neighbor discovery proxy
  - IPv6 address assignment
  - NAT66, NAT46, NAT64, and DNS64
  - DHCPv6 relay
  - IPv6 tunneling
  - IPv6 Simple Network Management Protocol
  - Dynamic routing in IPv6
    - OSPFv3 and IPv6
    - BGP and IPv6
  - IPv6 configuration examples
- FortiGate LAN extension
  - Example CLI configuration
  - Example GUI configuration
  - DHCP client mode for inter-VDOM links
  - FortiGate secure edge to FortiSASE
  - WiFi access point with internet connectivity
- SCTP packets with zero checksum on the NP7 platform
- Industrial Connectivity
- Diagnostics
  - Using the packet capture tool
  - Using the debug flow tool
SD-WAN
- SD-WAN overview
  - SD-WAN components and design principles
  - SD-WAN designs and architectures
- SD-WAN quick start
- SD-WAN members and zones
- SD-WAN performance SLA
- SD-WAN rules
- SD-WAN Underlay Bandwidth and Quality Monitoring service
  - Application performance and configuration
  - Speed tests
- Overlay
- Routing
- Security
- Advanced configuration
- Troubleshooting SD-WAN
- SD-WAN cloud on-ramp
Zero Trust Network Access
- Zero Trust Network Access introduction
- ZTNA advanced configurations
- ZTNA configuration examples
- ZTNA troubleshooting and debugging commands
- ZTNA troubleshooting scenarios
- ZTNA troubleshooting with error messages
Policy and Objects
- Policies
- Address objects
- Protocol options
  - Stripping the X-Forwarded-For value in the HTTP header
- Traffic shaping
- Internet Services
Security Profiles
- Inspection modes
  - Flow mode inspection (default mode)
  - Proxy mode inspection
  - Inspection mode feature comparison
- AI protection
  - Protecting GenAI access using web filter
  - Protecting GenAI access using application control
  - Protecting GenAI Access using DLP
- Antivirus
  - Antivirus introduction
  - Advanced configurations
  - Configuration examples
- Web filter
  - Web filter introduction
  - Advanced CLI configuration
  - Configuration examples
- Video filter
  - Filtering based on FortiGuard categories
  - Filtering based on YouTube channel
  - Filtering based on title
  - Filtering based on description
  - Configuring a video filter keyword list
  - Replacement messages displayed in blocked videos
- DNS filter
  - Configuring a DNS filter profile
  - FortiGuard category-based DNS domain filtering
  - Botnet C&C domain blocking
  - DNS safe search
  - Local domain filter
  - DNS translation
  - Applying DNS filter to FortiGate DNS server
  - DNS inspection with DoT and DoH
  - DNS over QUIC and DNS over HTTP3 for transparent and local-in DNS modes
  - Troubleshooting for DNS filter
- Telemetry profile
  - Creating telemetry profiles
- Application control
  - Configuring an application sensor
  - Application matching signature priority
  - Basic category filters and overrides
  - Excluding signatures in application control profiles
  - Port enforcement check
  - Protocol enforcement
  - SSL-based application detection over decrypted traffic in a sandwich topology
  - Matching multiple parameters on application control signatures
  - Application signature dissector for DNP3
  - Domain fronting protection
- Inline CASB
  - Inline CASB examples
- Intrusion prevention
  - Signature-based defense
  - Configuring an IPS sensor
  - IPS configuration options
  - SCTP filtering capabilities
  - Diameter protocol inspection
  - IPS signature filter options
  - IPS with botnet C&C IP blocking
  - IPS signatures for the operational technology security service
  - IPS sensor for IEC 61850 MMS protocol
  - IPS Modbus TCP decoder
  - AI and ML-based IPS detection
  - Support Ethernet layer protocols in the IPS engine
- File filter
  - Supported file types
- Email filter
  - Configuring an email filter profile
  - Local-based filters
  - FortiGuard-based filters
  - Third-party-based filters
  - Filtering order
  - Protocols and actions
  - Configuring webmail filtering
  - Spam email header
- VoIP solutions
  - General use cases
  - NAT46 and NAT64 for SIP ALG
  - SIP message inspection and filtering
  - SIP ALG and SIP session helper
  - SIP pinholes
  - SIP over TLS
  - Voice VLAN auto-assignment
  - Scanning MSRP traffic
- ICAP
  - ICAP configuration example
  - ICAP response filtering
  - Secure ICAP clients
  - ICAP scanning with SCP and FTP
  - Domain name in XFF with ICAP
  - Selective forwarding to ICAP server
- Web application firewall
  - Protecting a server running web applications
- Data loss prevention
  - DLP techniques
  - Basic DLP settings
  - Advanced DLP configurations
  - DLP fingerprinting
  - FortiGuard DLP service
  - Sensitivity labels
  - Exact data matching
  - DLP examples
- Virtual patching
  - OT virtual patching basic examples
  - OT and IoT virtual patching on NAC policies
- SSL & SSH Inspection
  - Configuring an SSL/SSH inspection profile
  - Certificate inspection
  - Deep inspection
  - Protecting an SSL server
  - Handling SSL offloaded traffic from an external decryption device
  - SSH traffic file scanning
  - Redirect to WAD after handshake completion
  - HTTP/2 support in proxy mode SSL inspection
  - Define multiple certificates in an SSL profile in replace mode
  - Disabling the FortiGuard IP address rating
  - Block or allow ECH TLS connections
  - Configuring certificate probe failure option
- Custom signatures
  - Configuring custom signatures
  - Blocking applications with custom signatures
  - Filters for application control groups
  - Application groups in traffic shaping policies
- Overrides
  - Web rating override
  - Using local and remote categories
  - Web profile override
- IP ban
  - IP ban using the CLI
  - IP ban using security profiles
  - Configuring the persistency for a banned IP list
- Profile groups
IPsec VPN
- General IPsec VPN configuration
- Site-to-site VPN
  - FortiGate-to-FortiGate
  - FortiGate-to-third-party
- Remote access
- Aggregate and redundant VPN
- ADVPN
- Fabric Overlay Orchestrator
- Other VPN topics
- VPN IPsec troubleshooting
  - Understanding VPN related logs
  - IPsec related diagnose commands
Agentless VPN
- Agentless VPN portal configurations
- Quick Connection tool
- Agentless VPN bookmarks
- Agentless VPN for remote users
- Customizing the RDP display size
- Showing the Agentless VPN web portal login page in the browser's language
- Agentless VPN custom landing page
- Agentless VPN protocols
  - TLS 1.3 support
  - SMBv2 support
- Agentless VPN security best practices
- Agentless VPN authentication
- Disable the clipboard for Agentless VPN RDP connections
- Agentless VPN troubleshooting
  - Debug commands
  - Troubleshooting common issues
User & Authentication
- User definition, groups, and settings
- Basic authentication with cached client certificates
- LDAP servers
- RADIUS servers
- SAML
- TACACS+ servers
- SCIM servers
- Bearer token authentication for SCIM servers
- FortiTokens
- PKI
  - Configuring a PKI user
  - Using the SAN field for LDAP-integrated certificate authentication
- FSSO
- Include usernames in logs
Wireless configuration
Switch Controller
System
- Administrators
  - Local authentication
  - Remote authentication for administrators
  - Administrator account options
  - REST API administrator
  - SSO administrators
  - FortiCloud SSO
  - Allowing the FortiGate to override FortiCloud SSO administrator user permissions
  - Password policy
  - Public key SSH access
  - Separating the SSHD host key from the administration server certificate
  - Restricting SSH and Telnet jump host capabilities
  - Restricting local administrator logins through the console
  - Remote administrators with TACACS+ VSA attributes
- Administrator profiles
- Firmware & Registration
  - About firmware installations
  - Firmware labels
  - Upgrading individual devices
  - Upgrading all devices
  - Registering devices
  - Enabling automatic firmware upgrades
    - Automatic firmware upgrades for FortiGate appliances with invalid support contracts or that have reached EOES
  - One-time upgrade prompt when a critical vulnerability is detected upon login
  - Viewing firmware upgrade reports
  - Authorizing devices
  - Firmware upgrade notifications
  - Downloading a firmware image
  - Testing a firmware version
  - Installing firmware from system reboot
  - Restoring from a USB drive
  - Using controlled upgrades
  - Downgrading individual device firmware
  - Downloading the EOS support package for supported Fabric devices
  - How the FortiGate firmware license works
  - Enhanced firmware upgrade management for extension devices New
- Settings
  - Default administrator password
  - Changing the host name
  - Setting the system time
    - Cryptographic hash function authentication support
    - PTPv2
  - Configuring ports
    - Custom default service port range
  - Setting the idle timeout time
  - Setting the password policy
  - Changing the view settings
  - Setting the administrator password retries and lockout time
  - TLS configuration
  - Controlling return path with auxiliary session
  - Email alerts
  - Using configuration save mode
  - Trusted platform module support
  - Using the default certificate for HTTPS administrative access
  - Configure TCP NPU session delay globally
- Virtual Domains
  - VDOM overview
  - General configurations
  - Configuring global profiles
  - Backing up and restoring configurations in multi-VDOM mode
  - Inter-VDOM routing configuration example: Internet access
  - Inter-VDOM routing configuration example: Partial-mesh VDOMs
- High Availability
  - FGCP
  - FGSP
  - Standalone configuration synchronization
    - Layer 3 unicast standalone configuration synchronization
  - VRRP
  - Session failover
- SNMP
  - Basic configuration
  - MIB files
  - Access control for SNMP
  - Important SNMP traps
  - SNMP traps and automation-stitch notifications for DIO module
  - SNMP examples
- Replacement messages
- Replacement message groups
- FortiGuard
  - Anycast
  - Configuring FortiGuard updates
  - Using a proxy server to connect to the FortiGuard Distribution Network
  - Manual updates
  - Automatic updates
  - Scheduled updates
  - Sending malware statistics to FortiGuard
  - Update server location
  - Filtering
  - Online security tools
  - Anycast and unicast services
  - Using FortiManager as a local FortiGuard server
  - Cloud service communication statistics
  - IoT detection service
  - FortiAP query to FortiGuard IoT service to determine device details
  - FortiGate Cloud / FDN communication through an explicit proxy
  - FDS-only ISDB package in firmware images
  - Licensing in air-gap environments
  - License expiration
  - FortiGate GovRamp support
  - Disable all cloud communication
  - AMQP-powered subscription notifications for FortiGuard
- Feature visibility
- Certificates
  - Automatically provision a certificate
  - Generate a new certificate
  - Regenerate default certificates
  - Import a certificate
  - Generate a CSR
  - CA certificate
  - Remote certificate
  - Certificate revocation list
  - Export a certificate
  - Uploading certificates using an API
  - Procuring and importing a signed SSL certificate
  - Microsoft CA deep packet inspection
  - Administrative access using certificates
  - Creating certificates with XCA
  - Enrollment over Secure Transport for automatic certificate management
  - ACME External Account Binding support
- Security
  - BIOS-level signature and file integrity checking
  - Real-time file system integrity checking
  - Running a file system check automatically
  - Built-in entropy source
  - FortiGate VM unique certificate
  - Closed network VM license security
  - Encrypt configuration files in the eCryptfs file system
  - FIPS-CC mode and OpenSSL FIPS provider
  - Enhanced administrator password security
- Configuration scripts
- Workspace mode
- Custom languages
- RAID
- FortiGate encryption algorithm cipher suites
- Conserve mode
- Using APIs
- Configuration backups and reset
- Fortinet Support Tool for capturing incidents
Fortinet Security Fabric
- Components
- Security Fabric connectors
- Using the Security Fabric
- Configuring the Security Fabric with SAML
- Security rating
- Automation stitches
- Public and private SDN connectors
- Endpoint/Identity connectors
- External feeds
- Generic connector for importing addresses
- Troubleshooting
  - Viewing a summary of all connected FortiGates in a Security Fabric
  - Diagnosing automation stitches
Log and Report
- Viewing event logs
- System Events log page
- Security Events log page
- Reports page
- Log settings and targets
- Logging to FortiAnalyzer
- Advanced and specialized logging
- Sample logs by log type
- Troubleshooting
WAN optimization
- Overview
- Example topologies
- Configuration examples
VM
- Amazon Web Services
- Microsoft Azure
- Google Cloud Platform
- OCI
- AliCloud
- Private cloud
- VM license
- Permanent trial mode for FortiGate-VM
- Adding VDOMs with FortiGate v-series
- PF and VF SR-IOV driver and virtual SPU support
- Using OCI IMDSv2
- FIPS cipher mode for AWS, Azure, OCI, and GCP FortiGate-VMs
- Cloud-init
- TPM support for FortiGate-VM
Hyperscale firewall
Troubleshooting
- Troubleshooting methodologies
- Connectivity Fault Management
- Troubleshooting scenarios
- CLI troubleshooting cheat sheet
- CLI error codes
- Additional resources
Change Log

Home FortiGate / FortiOS 7.6.4 Administration Guide

7.6.4

Applying multi-factor authentication

Multi-factor authentication (MFA) may also be set up for Agentless VPN users, administrators, firewall policy, wireless users, and so on. The following topics explain more about how you may use the newly created user in such scenarios:

MFA for IPsec VPN: Add FortiToken multi-factor authentication
MFA for Administrators: Administrator account options
MFA with Captive Portal
MFA for wireless users via Captive Portal
Configuring FSSO firewall authentication

Applying multi-factor authentication

MFA for IPsec VPN: Add FortiToken multi-factor authentication
MFA for Administrators: Administrator account options
MFA with Captive Portal
MFA for wireless users via Captive Portal
Configuring FSSO firewall authentication

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Unified SASE

Single Vendor SASE

Cloud Network Security

Secure Endpoint Connectivity

Web Application / API Protection

Security Operations

Security Operations Automation

Identity

Early Detection & Prevention

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Communication & Surveillance

Unified SASE

Single Vendor SASE

Secure Endpoint Connectivity

Cloud Network Security

Cloud-Native Security

Web Application / API Protection

Security Operations

Security Operations Automation

Endpoint

Data Protection

Identity

Email

Early Detection & Prevention

Expert Services

Edge Firewall

Orchestration & management

SD Branch

Application Delivery

Single Vendor SASE

Secure Endpoint Connectivity

Secure Private Access

Thin Edge

Identity

Application Gateway

Enterprise Asset Management

Endpoint Agent

Agentless Security Posture

Identity

Wireless

Switching

Identity

Privilege Acccess Management

Next Generation Firewall

Orchestration & management

Expert Services

Web Application / API Protection

All

All

Account Management

SAAS Management

SAAS Application Security

Managed Services

Platform as a service (PAAS)

Other SAAS Services

4D Pillars

Cloud

Popular Solutions

All Products

Administration Guide

Applying multi-factor authentication

Applying multi-factor authentication

Applying multi-factor authentication

Applying multi-factor authentication