topic Re: Change AD password through checkpoint VPN after implementing 2FA with forti token in SASE and Remote Access

Change AD password through checkpoint VPN after implementing 2FA with forti token

kboukis — Mon, 07 Jun 2021 06:21:49 GMT

Hey all,

I had configured LDAPs and everything was ok, we could change expired password from checkpoint VPN, but now that we added/implemented 2FA from fortinet, we lost the ability to change the password. If the password has expired, the fortinet log says that the password must be changed and it just gives the user wrong password message.

Is there a way around this?

thank you

Re: Change AD password through checkpoint VPN after implementing 2FA with forti token

_Val_ — Wed, 09 Jun 2021 07:55:57 GMT

I suspect this question should be actually directed to Fortinet 🙂

Re: Change AD password through checkpoint VPN after implementing 2FA with forti token

Norbert_Bohusch — Wed, 09 Jun 2021 10:14:04 GMT

I assume you are using only one authentication (Radius) to authenticate against Forti Token, so everything happening, like AD authentication and expired password handling should be done by Forti...

Re: Change AD password through checkpoint VPN after implementing 2FA with forti token

PhoneBoy — Wed, 09 Jun 2021 23:38:51 GMT

How is the MFA from Fortinet implemented exactly?

Re: Change AD password through checkpoint VPN after implementing 2FA with forti token

kboukis — Thu, 10 Jun 2021 06:20:55 GMT

Yes you are right, all are done through forti. I needed to change from PAP to MSCHAPv2 on checkpoint and also install a certificate on forti and change to ldaps on forti. It is working but it is not notifying the user that their password has been changed which is kind of annoying.

Re: Change AD password through checkpoint VPN after implementing 2FA with forti token

kboukis — Thu, 10 Jun 2021 06:22:16 GMT

On checkpoint I have set the RADIUS server to be the forti server and then forti takes over. It is working fine but it is getting a bit complex 🙂