<Partner Name>

<Partner Product>

RSA SECURID® ACCESS

Standard Agent Client
Implementation Guide

Fortinet FortiClient 6.0

FortiGate 5.6

Yiqiang Wang, RSA Partner Engineering

John Sammon, RSA Partner Engineering
Last Modified: November 2, 2018
Fortinet
FortiClient 6.0

Solution Summary
FortiClient integrates endpoint security with network security through the Fortinet Security Fabric and
delivers endpoint visibility, compliance control, vulnerability management, and automation. It proactively
defends endpoints with pattern-based anti-malware technology, behavior-based exploit protection, web-
filtering, and an application firewall.
FortiClient can be configured to establish IPsec and SSL VPN connections to FortiGate, which supports
RSA SecurID Access authentication. You can configure FortiGate to allow organizations to secure their
resources by requiring FortiClient end-users to authenticate with RSA SecurID hardware or software
tokens and/or SecurID Access Cloud Authentication Service multifactor authentication methods.
RSA SecurID Access Features
Fortinet FortiClient 6.0.1/FortiGate 5.6

Authentication Manager Methods

RSA SecurID Yes
On Demand Authentication Yes
Risk-Based Authentication No
Cloud Authentication Service Methods
Authenticate App Yes
FIDO Token No

Identity Assurance

Collect Device Assurance and User Behavior No

Software Token Automation

Windows No
Mac No
Android No
iOS No

-- 2 -
Fortinet
FortiClient 6.0

Partner Product Configuration

Before You Begin
This section provides instructions for configuring FortiClient to connect to a FortiGate appliance that has
been configured to use RSA SecurID Access for RSA SecurID two-factor authentication and/or RSA Cloud
Authentication Service multifactor authentication methods. This document is not intended to suggest
optimum installations or configurations.
FortiGate must be configured for RSA Authentication Manager/RSA Cloud Authentication Service RADIUS
SecurID authentication prior to the integration. See the FortiGate RSA SecurID Access implementation
guide for more information.

Important: You must configure the FortiGate integration with either RSA
Authentication Manager or RSA Cloud Authentication Server before you continue. See
the Fortinet FortiGate 5.6 RSA SecurID Access implementation guide for details.

FortiGate Client Configuration

The instructions for configuring a VPN connection configuration are the same for the iOS, Android,
Windows and macOS clients. The screen captures below provide an example of each configuration. You
will be required to enter a name to identify your connection, the IP address/port of your FortiGate VPN
host. You may enter your username if you want the client to prepopulate the username field each time
you log in. For advanced configuration options and requirements, contact your FortiGate administrator
and consult your FortiGate and FortiClient documentation.

FortiClient for iOS

-- 3 -
Fortinet
FortiClient 6.0

FortiClient for Android

-- 4 -
Fortinet
FortiClient 6.0

FortiClient for Windows

-- 5 -
Fortinet
FortiClient 6.0

FortiClient for macOS

-- 6 -
Fortinet
FortiClient 6.0

RSA SecurID Login Screens

FortiClient for iOS (RSA Authentication Manager Login Screens)

RSA SecurID Passcode Login Screen

Confirm System-generated PIN Prompt System-generated PIN Prompt

New PIN Prompt Next Tokencode Prompt

-- 7 -
Fortinet
FortiClient 6.0

FortiClient for iOS (RSA Cloud Authentication Service Login Screens)

Password Login Screen RSA SecurID Passcode Login Screen

New PIN Prompt System Generated PIN Prompt

Next Tokencode Prompt Multiple Authentication Options

-- 8 -
Fortinet
FortiClient 6.0

SMS Tokencode Prompt Voice Tokencode Prompt

Biometrics Prompt

-- 9 -
Fortinet
FortiClient 6.0

FortiClient for Android (RSA Authentication Manager Login Screens)

RSA SecurID Passcode Login Screen

-- 10 -
Fortinet
FortiClient 6.0

New PIN Prompt

Confirm New PIN Prompt

Next Tokencode Prompt

-- 11 -
Fortinet
FortiClient 6.0

Confirm System-Generated PIN Prompt

System-Generated PIN Prompt

-- 12 -
Fortinet
FortiClient 6.0

FortiClient for Android (RSA Cloud Authentication Service Login Screens)

Password Login Screen

-- 13 -
Fortinet
FortiClient 6.0

Passcode Login Screen

New PIN Prompt

System-Generated PIN Prompt

-- 14 -
Fortinet
FortiClient 6.0

Next Tokencode Prompt

Cloud Tokencode Prompt

Approve Prompt

-- 15 -
Fortinet
FortiClient 6.0

Biometrics Prompt

SMS Tokencode Prompt

Voice Tokencode Prompt

-- 16 -
Fortinet
FortiClient 6.0

FortiClient for Windows (RSA Authentication Manager Login Screens)

RSA SecurID Passcode Login Screen

New PIN Prompt

-- 17 -
Fortinet
FortiClient 6.0

Next Tokencode Prompt

Confirm System-Generated PIN Prompt

System-Generated PIN Prompt

-- 18 -
Fortinet
FortiClient 6.0

FortiClient for Windows (RSA Cloud Authentication Service Login Screens)

Password Login Screen

RSA SecurID Passcode Login Screen

-- 19 -
Fortinet
FortiClient 6.0

New PIN Prompt

System Generated PIN Prompt

Next Tokencode Prompt

-- 20 -
Fortinet
FortiClient 6.0

Multiple Authentication Options

Approve Prompt

Biometrics Prompt

-- 21 -
Fortinet
FortiClient 6.0

SMS Tokencode Prompt

Voice Tokencode Prompt

-- 22 -
Fortinet
FortiClient 6.0

FortiClient for macOS (RSA Authentication Manager Login Screens)

RSA SecurID Passcode Login Screen

-- 23 -
Fortinet
FortiClient 6.0

New PIN Prompt

-- 24 -
Fortinet
FortiClient 6.0

Confirm New PIN Prompt

-- 25 -
Fortinet
FortiClient 6.0

Confirm System-Generated PIN Prompt

-- 26 -
Fortinet
FortiClient 6.0

System-Generated PIN Prompt

-- 27 -
Fortinet
FortiClient 6.0

Next Tokencode Prompt

-- 28 -
Fortinet
FortiClient 6.0

FortiClient for macOS (RSA Cloud Authentication Service Login Screens)

Password Login Screen

-- 29 -
Fortinet
FortiClient 6.0

Passcode Login Screen

-- 30 -
Fortinet
FortiClient 6.0

New PIN Prompt

-- 31 -
Fortinet
FortiClient 6.0

System-Generated PIN Prompt

-- 32 -
Fortinet
FortiClient 6.0

Cloud Tokencode Prompt

-- 33 -
Fortinet
FortiClient 6.0

Approve Prompt

-- 34 -
Fortinet
FortiClient 6.0

Biometrics Prompt

-- 35 -
Fortinet
FortiClient 6.0

SMS Tokencode Prompt

-- 36 -
Fortinet
FortiClient 6.0

Voice Tokencode Prompt

-- 37 -
Fortinet
FortiClient 6.0

Certification Checklist for RSA SecurID Access

RSA Authentication Manager
Certification Environment Details:
RSA Authentication Manager 8.2, Virtual Appliance
FortiGate5.6.6, Virtual Appliance
FortiClient for iOS 9.0.0 or higher
FortiClient for Android 4.1 or higher
FortiClient for Windows 10 and Windows Phone 10

RSA SecurID Authentication

Dates Tested: Oct 19 – Oct 30 , 2018
Windows macOS Android iOS

REST N/A N/A N/A N/A

UDP Agent N/A N/A N/A N/A
TCP Agent N/A N/A N/A N/A
RADIUS

= Pass = Fail N/A = Non-Available Function

= Pass = Fail N/A = Non-Available Function

-- 38 -
Fortinet
FortiClient 6.0

RSA Cloud Authentication Service

Certification Environment Details:
RSA Authentication Manager 8.2, Virtual Appliance
FortiGate 5.6.6, Virtual Appliance
FortiClient 6.0.1 for iOS
FortiClient 6.0.1 for Android
FortiClient 6.0.1for Windows 10
FortiClient 6.0.1 for macOS

RADIUS
Date Tested: Oct 19 – Oct 30 , 2018
Windows macOS Android* iOS Other

RSA SecurID N/A

LDAP Password N/A
Authenticate Approve N/A
Authenticate Tokencode N/A
Device Biometrics N/A
SMS Tokencode N/A
Voice Tokencode N/A

= Pass = Fail N/A = Non-Available Function

-- 39 -