What is the correct sequence to enable two-factor authentication for FortiGate admin access?

What is the correct sequence to enable two-factor authentication for FortiGate admin access?

• A. Enable MFA for admin accounts, configure MFA in admin settings, and require MFA in the login policy.
• B. Install a separate MFA app on client devices.
• C. Disable MFA to simplify login.
• D. Create a new admin group with a default password.

Answer: (A)

To enable two-factor authentication for FortiGate admin access, you need a three-step approach that ties the second factor to admin login. First, turn on MFA for the admin accounts so those accounts are capable of using a second factor during login. Without this, the system won’t prompt for a second factor. Next, configure the MFA method in the admin settings so FortiGate knows which second-factor mechanism to use (for example, FortiToken or an external partner like a RADIUS server). This step selects and activates the actual method that will be presented to the user. Finally, require MFA in the login policy so the system enforces the second factor at every login attempt. Enforcing it ensures that even if MFA is configured and available, users must provide the second factor to gain access. Other options don’t fit the full flow: simply installing an MFA app on devices or disabling MFA doesn’t enforce two-factor authentication, and creating an admin group with a default password does not implement or enforce 2FA and leaves accounts insecure.

To enable two-factor authentication for FortiGate admin access, you need a three-step approach that ties the second factor to admin login. First, turn on MFA for the admin accounts so those accounts are capable of using a second factor during login. Without this, the system won’t prompt for a second factor. Next, configure the MFA method in the admin settings so FortiGate knows which second-factor mechanism to use (for example, FortiToken or an external partner like a RADIUS server). This step selects and activates the actual method that will be presented to the user. Finally, require MFA in the login policy so the system enforces the second factor at every login attempt. Enforcing it ensures that even if MFA is configured and available, users must provide the second factor to gain access.

Other options don’t fit the full flow: simply installing an MFA app on devices or disabling MFA doesn’t enforce two-factor authentication, and creating an admin group with a default password does not implement or enforce 2FA and leaves accounts insecure.