MFA method for FortiClinet VPN connection

Question

MFA method for FortiClinet VPN connection

Dan 86

Hello,

I am currently conducting tests on the integration of the Microsoft Authenticator app with VPN login on our FortiGate VPN.

Within our infrastructure, we have deployed both the FortiGate firewall and a Network Policy Server (NPS). The NPS server and FortiGate configurations have been successfully implemented.

However, I am encountering an issue where, during VPN login, I am required to manually open the MS Authenticator app and enter a 6-digit code. I am seeking a solution to enable push notifications for a more seamless authentication process with MS Authenticator during VPN connections. Is there a method to implement push notifications for MS Authenticator in this context?

Accepted answer

0 additional answers

Your answer

Answer 1

Domooney-MSFT 2,606 Microsoft Employee

Hi Dan,

Thank you for posting your query on Microsoft Q&A!

There is a registry key you can add to your NPS server which can force the MFA method to push notifications.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AzureMfa

Create the following String/Value pair:

Name: OVERRIDE_NUMBER_MATCHING_WITH_OTP

Value = FALSE

We have details on this here - https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-nps-extension-vpn

Let me know if you have any further queries or issues and I would be happy to help!

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Dan 86 Reputation points

2023-11-30T16:14:34.3433333+00:00

Hello,

thanks for the feedback and the answer. I have added the registry key and now I get Entra ID Authenticator app push notification.

Now I get a error message when I confirm the MFA push notification:

Previously the VPN connection worked without any issue. Is there any other configuration that needs to be done either on NPS of Fortigate?
Domooney-MSFT 2,606 Reputation points Microsoft Employee

2023-11-30T16:42:33.4133333+00:00

Thanks for that Dan,

Do you see any errors in the Azure AD sign-in logs? Do push notifications work as normal for sign-in's to cloud based applications?

We have some details here around which methods are supported by the NPS extension - https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-nps-extension#determine-which-authentication-methods-your-users-can-use

I'm not sure if there is any specific configuration needed with Fortigate, its possible the default was changed to verification code due to problems with the "Number matching" feature which was recently released.
Dan 86 Reputation points

2023-12-01T06:48:49.1433333+00:00

Thanks for the answer. The issue was in VPN profile config. For push notifications to work VPN profile Authentication needs to be set as: Prompt on login.

Share via

MFA method for FortiClinet VPN connection

0 additional answers

Your answer