Скачать или смотреть How to Set up Duo MFA for FortiGate SSL VPN (LDAP/RADIUS) | Step-by-Step Tutorial

​🔰 In This Step-by-Step Tutorial, You Will Learn How To:

1. Create your Duo account and switch to Free plan
2. Configure the Duo Auth Proxy on Ubuntu 24.04.
3. Set up a Duo application and Externa Directories (AD sync) in Duo admin panel
4. Integrate Duo MFA with FortiGate SSL VPN using LDAP/RADIUS.
5. Test login & show successful Duo Push/code

🔗 Official Documentation: https://duo.com/docs/fortinet

Install Duo Proxy on Ubuntu:

1️⃣ Install required packages:
sudo apt update
sudo apt install -y build-essential gcc make libffi-dev libssl-dev zlib1g-dev python3 python3-venv python3-pip

2️⃣ Download Duo Authentication Proxy:
wget https://dl.duosecurity.com/duoauthpro...

3️⃣ Extract and build:
tar xzf duoauthproxy-latest-src.tgz
cd duoauthproxy-latest-src/
make

4️⃣ Install (as root):
cd duoauthproxy-build
./install

5️⃣ Configure and start service:
/opt/duoauthproxy/conf/authproxy.cfg
/opt/duoauthproxy/bin/authproxyctl start
/opt/duoauthproxy/bin/authproxyctl status

Sample Configuration (authproxy.cfg):

LDAP :

[ad_client]
host=1.2.3.4
service_account_username=duoservice
service_account_password=password1
search_dn=cn=Users,dc=example,dc=com

[ldap_server_auto]
client=ad_client
ikey=ikey_generated_by_duo_site
skey=skey_generated_by_duo_site
api_host=api_host_generated_by_duo_site
failmode=safe
exempt_ou_1=cn=fortigate_svc,ou=example,dc=example,dc=com
exempt_primary_bind=false

;Active Directory Sync
[cloud]
ikey=ikey_generated_by_duo_site
skey=skey_generated_by_duo_site
api_host=api_host_generated_by_duo_site
service_account_username=duoservice
service_account_password=password1

-------------------------------------------------------------------------
RADIUS:

[radius_client]
host=IP_of_NPS
secret=Shared_secret_with_NPS
pass_through_all=true

[radius_server_auto]
ikey=XXXXXXXXXXXXXXXXXXXX
skey=XXXXXXXXXXXXXXXXXXXX
api_host=XXXXXXXXXXXXXXXXXXXX
radius_ip_1=UPSTREAM-RADIUS-IP
radius_secret_1=UPSTREAM-SECRET
failmode=safe
client=radius_client
port=1812
force_message_authenticator=true

🧠 Tip: Add force_message_authenticator=true in new Duo versions.
📹 Watch the full tutorial in the video for step-by-step guidance