Controlling risky conditions

Adaptive Authentication

You can bypass OTP verification of MFA under certain “safer” conditions and deny such attempts under some otherwise “risky” conditions. You can pre-configure OTP verification of MFA based on trusted subnet/geo-location and time of day/day of week. For more details about how to configure it, go to Adaptive authentication.

Creating adaptive authentication policy

1. Click Settings>Adaptive Auth>Policies.

2. Click Add Policy.

3. Make the desired entries and/or selections.

4. Click Apply.

Creating adaptive authentication profile

1. Click Settings>Adaptive Auth > Profiles.

2. Click Add Profile.

3. Make the desired entries and/or selections.

4. Click Apply.

Applying adaptive authentication profile to an application

1. Click Applications > FortiProducts.

2. Locate the application of interest, and click Edit in the pop-up tool menu.

3. Select an adaptive auth profile.

4. Click Apply.

Applying adaptive authentication profile to a realm

1. Click Settings > Realm > General.

2. Scroll down to Adaptive Auth Profile, and select a profile.

3. Click Apply Changes.

Last login

The Last Login feature enables you to let end-users use trusted IPs or subnets to log in by bypassing the MFA requirement within a specified time period.

Enabling the Last Login feature in Adaptive Auth Policy

1. Click Settings > Adaptive Auth > Policies.

2. Specify a unique name.

3. For Action, select Bypass MFA

4. For Filters, select Subnet Filter.

5. In the Subnets field, enter the IP address or subnet, and click the + sign. (Note: The IP or Subnet must be supported by the FortiProduct).

6. Click Last Login and specify a reasonable MFA Interval time period. (Note: The range of this period is from 1 to 72 hours.)

7. Select a schedule configuration set in the Schedule section.

8. Click Apply.

9. Add the newly created policy to a profile and select the same action, i.e., Bypass MFA.

10. Apply the newly created profile to any applications (including FortiProducts and Web Apps) and any realms whose users are going to use those trusted IPs or Subnets.

Impossible travel

The Impossible Travel feature enables FIC to detect and block suspicious login attempts. Upon detecting a login request coming far away from the normal geographical location, for example, a login request from Russia for a device used by an employee who is based in the United States, FIC will block it. Using this feature, FIC can effectively identify suspicious sign-in attempts based on the distance and time elapsed between two subsequent user sign-in attempts. The feature works with IP addresses in the format that FortiProducts support.

Enabling the Impossible Travel feature in Adaptive Authentication policy:

1. Click Adaptive Auth > Policy > Add Policy.

2. Enter a unique policy name.

3. For Actions, select Enforce MFA/Block.

4. Select Location Filter.

5. Select the country or countries.

6. Click Impossible Travel.

7. Select a schedule configuration in the Schedule section.

8. Click Apply.

9. Add the policy to any profile. Be sure to select the same action, i.e., Enforce MFA/Block.

10. Apply the profile to any applications (including FortiProducts and Web Apps) and any Realms whose users are going to log in from those locations.