Cisco Duo with Fortigate VPN

FortiGate Remote Access VPN with Cisco Duo MFA works by integrating Duo’s two-factor authentication into the VPN login flow. When a user connects through SSL-VPN or IPsec VPN on the FortiGate, they first authenticate with their primary credentials, then Duo pushes a second-factor challenge before granting access. This ensures only verified users can establish a secure VPN session.

Enabling Duo MFA

Here we have a working Fortigate IPSec Remote Access VPN using local users to log in

To enable Duo, we’ll pretty much follow a similar implementation as this one, first we make sure the user is present on Duo with same username as the one on AD

Then we add a Protected Application, Duo already provides a template for Fortigate SSL VPN so lets use that, even though actually we use IPSec but the authentication process is the same

Copy all the necessary credentials

And configure it on the Duo Proxy Server

Next on the Fortigate, create a new Radius Server pointing to the Duo Proxy Server

We can also test the MFA right from this menu

Then add the newly created Radius Object to the VPN User Group thats used on the VPN configuration

And we also increase the radius timeout to give users time to approve the MFA prompt

And now if we connect to VPN using AD users, we’ll be prompted a Duo MFA

We can still connect to VPN using local users with no MFA because we still allow this user on the VPN Group