Fortinet FortiToken Reviews

We're using a third-party tool for second-level authentication. So, basically, we integrated our Office 365 to Active Directory for additional service, and our users need to provide the SSH people to log in. So we wanted to use that ticket, which is not scalable. So that's why it should be what we basically use FortiToken for now is to ensure that administrators who log into the box have to provide additional proof at the DCB app.

I love the push-button authentication on FortiToken Mobile. It's also great that the soft token automatically reloads the OTP at intervals, so I always have a fresh code to enter. 

I also appreciate that you need to specify the token to gain access to the box, even from the command line. So I love it also because of the fact that people can no longer log in to my box without knowing who the users are. At least, anytime we log in to the admin, which has the tool enabled on my account. So it helps me to basically keep track of who and who are trying to access my box.

I would like to see if FortiToken can integrate with Office 365 mail to support the same two-factor authentication experience that I have with ESET. With ESET, when a user logs in, they are easily directed to the ESET authentication page, where they are prompted to enter their OTP after supplying their username and password. I understand from support that FortiToken cannot do this with email integration. That's why I opted for ESET. 

In future releases,  it would be great to see Fortinet add this support in the future.

I have been using this solution for quite some while. We use the mobile version. 

It is a stable product. 

We easily move from the prem to the cloud and vice versa. So, it is a scalable solution. We have around three end users using this solution. 

The setup is straightforward. I had a problem setting up FortiToken on ESET for Active Directory users because most of my users are integrated into Active Directory. There was a problem setting up FortiToken on the accounts that are not locally stored on the FortiGate, but I was able to fix the issue with the help of support. Overall, I'm happy with the setup process.

The deployment was straightforward. If you're using Fortinet cloud or FortiToken phone mobile, once you enable that on the account, it sends you a link to download the application for the clients of FortiToken. It's something that can be done in less than a minute really.

I only had to use support when I couldn't get my users on the ED to install and set up a two-step authentication (2SA) on the account. That's because the way it was set up was it was looking for a particular filter, which was not on the ETA back on. The support was able to identify the feature to use, and I was able to resolve that. Otherwise, it's something you can do within thirty minutes or less than that.

Two admins are enough for the maintenance of the solution.

For the two licenses, I have a return on investment.

We have not added in for the commercial. What I used for my test was the two licenses that come with the FortiGate. At the point where I wanted to ask for commercial support, it didn't support what I needed it for. So that's why I didn't confirm my price with anything because I didn't need that at that point.

I only have the two free licenses, except maybe when I increase the number of local users I have that need to be able to use VPN and all that, then I would have to pay for those licenses. But for now, because the third-party tool I have supports both my VPN and my email, so I really don't need to use FortiToken now.

Overall, I would rate the solution a nine out of ten. For someone who just needs basic availability for users, I would recommend what they could use for that.

We use the solution for two-factor authentication. If anybody we have set up on FortiAuthenticator needs two-factor authentication to log in, we use FortiToken.

Fortinet FortiToken’s licenses are perpetual. We do not have to pay monthly for multi-factor authentications like Duo or Okta. We can buy them once we pay for the license, and it's good for however long Fortinet wants to allow it to be good for. We can really save a lot of money buying a perpetual license versus paying monthly for a service like that. The solution is pretty solid. I never had to contact the technical support team.

We can only use the tool with the FortiToken Mobile app. If we could use it with other authenticator apps, it would definitely be an improvement.

I have been using the solution for about four years.

I rate the product’s stability a nine out of ten.

The tool is very scalable. We can just buy more tokens. It is very easy to scale. I rate the scalability a nine out of ten.

The initial deployment was straightforward.

I see an ROI on the product.

The solution’s price is good. I really like the price.

If someone doesn’t already have a method in place for two-factor authentication and if they use other Fortinet products, I would recommend the product to them. Overall, I rate the tool a nine out of ten.

I have used the solution for VPN access.

I like that the solution integrates with FortiAuthenticator well enough.

They're just the token. So, they perform like any other token. It's a very simple thing, and it just works like any other token. There's nothing that stands out. It's just another token.

It could be integrated better if you could have your FortiToken, and the license would allow you to work across multiple FortiGate solutions. So, that'd be an improvement.

I have been using Fortinet FortiToken for six or seven years. I have a lot of customers for the solution. I have no idea what version I'm using. I just have it on my phone, and I suppose it just updates automatically with other applications that update on my phone.

I haven't had any breaks, even when I use FortiToken application on Android or iPhones

Stability-wise, I rate the solution a ten out of ten.

Scalability-wise, I rate the solution a ten out of ten.

We have customers that have 2,500 people using the solution. Also, the company that we serve has around 1,000 users.

The initial setup was straightforward.

For deployment, load the CSV of all the tokens, and then with the license, we just deploy as required for users using Fortinet's indicators, usually.

The time taken for deployment depends on how long it takes to deploy the FortiAuthenticator. We usually deploy them together. With FortiAuthenticator, or the FortinetToken or add-ons, you're looking at maybe a couple of hours to edit.

The customers need to pay for licenses. On a scale of one to ten, where one is the cheapest, and ten is the highest, I rate the pricing an eight.

It's not as expensive as some other tools, and also it's cheaper than some solutions. The fact it integrates means there are not a lot of other costs. If you're a user of FortiGate or FortiAuthenticator, it's a good price.

To make it really work, you need FortiAuthenticator, so that's an additional cost. So it is your additional cost. Relative to other solutions, it is too cheap. We won't make any money if we make it cheaper.

If you have FortiGate, I would recommend using FortiToken. But if you have Office 365 and you have the MFA, then I'd suggest you use that.

Overall, I rate the solution a nine out of ten.

I am using it with FortiClient so that I can authenticate.

It provides me with the token so that I can do the Multi-Factor Authentication. I'm not sure if there's anything more to say about that.

I'm not sure if it's already available, however, I wonder if there's an option to have it sent to my email address instead of having it on the mobile app. Currently, I need to carry that single device that is already registered with a token. If I can receive it on email, it would be more flexible. 

I'm using other types of authenticators, and some of them provide a code to access the application. I'm not sure if that's already available, as I am not using it at the moment. If it's not there, it could be a nice feature to have optionally.

I have used the solution for four years, five years, something like that.

I don't know if scalability is applicable. It's only meant to be doing one thing, to be honest. I've already got, what, three or four tokens, four tokens. It's scalable enough for my purpose.

We get support through a partner, and we've had good support so far. However, it wasn't directly with Fortinet staff. 

Positive

The initial setup is simple.

I use Microsoft Authenticator as I can incorporate many functions there. With the FortiToken app, it's only compatible with its own tokens. So, I need to use one more app for what I need to do. Authenticator is for everything else, however, for Fortinet, I use only the FortiToken app.

The product is working fine for me after all these years.

Overall, I give the product a nine out of ten.

We use the solution only with Fortinet products for VPN.

During COVID-19, we needed server access from different places. The solution provides FortiToken Mobile. It makes things easier because we can have access through our mobiles instead of other devices. Thus, the solution made our application process better. Previously, the devices we used ran out of battery, so we had to throw them away. Now, the battery will not be drained as long as we don't use our mobile.

The product provides secure access to our internal server. The encryption is done by FortiToken. That is the reason we access our servers through Fortinet. We use FortiToken to ensure that no unauthorized person can access our servers. It is like two-factor authentication. It makes us more secure. The mobile application makes our authentication experience better. It is easy to integrate the solution with other products. I rate the ease of integration a nine out of ten.

The price must be more competitive. The pricing model must be more flexible. The tool could be a little cheaper.

I have been using the solution for four years.

I rate the tool’s stability a nine out of ten.

I rate the tool’s scalability a nine out of ten. We have about 30 users in our organization.

Sometimes, the support team takes time to understand the problem. However, it is okay. The team solves our issues.

Positive

We can contact the support team if we have any problems with the installation. The tool is easy to learn.

We evaluated another product, but the price and service of the reseller in Indonesia were not good. So, we did not choose it. We chose FortiToken because it was easy to integrate it.

I will recommend the product to others. Overall, I rate the product a nine out of ten.

We're aiming to provide every user with mobile token-based two-factor authentication (2FA) to enhance security.

It's for internal security.

It aligns well with your overall identity and access management (IAM) strategy.

We already have IAM policies in place, and this tool strengthens them by implementing 2FA.

The token-based authentication is good and modern aspect.

The management configuration seems a bit complex and could benefit from user guides or better support resources. It could be improved in terms of user-friendliness. 

Not like the other FortiGate products. Maybe not many people have a real community for this. The lack of community support is a major concern. 

Context-sensitive online support instead of just a general user manual would be very helpful. Currently, clicking "help" on any topic simply directs you to the entire manual.

We're currently in the middle of installing it.

As it's a virtual machine (VM), we haven't encountered any stability issues so far.

The support itself is good, but it mainly comes through email responses, which can be slow.

Email support is good, but we would appreciate faster response times.

We had internal authentication systems but not a product-based system from a security company.

Most of our previous authentication systems were internal. This is the first one that integrates with network and server equipment, and it can even be implemented for SSL. It's the first security system software we've used.

We chose Fortinet FortiToken because it integrates well with our existing Fortinet FortiGate firewall UTM appliance. Since the token is a VM, it doesn't require additional hardware, which would have been an unnecessary expense. In terms of manageability and integration, it seemed like a good fit alongside FortiGate and FortiMail, all from the same Fortinet ecosystem.

It is not very easy to set up and configure 2FA with different needs.

Configuration can be confusing due to the lack of community and context-sensitive help. We've had to rely on technical support, which slows down the setup process.

Token's validity is either renewal or perpetual, which determines its return on investment (ROI), which is higher over time. It's not a subscription-based model.

From an Indian perspective, it's definitely costlier. Converted to dollars, it might seem smaller internationally. But commercially in India, it is expensive.

Overall, I would rate the solution a six out of ten because some improvements are required feature-wise. For example, before FortiToken disappears from the mobile phone, it should display our logo, not the FortiToken logo. App customization is needed so users know when FortiToken is implemented. My organization, for instance, would prefer our logo for assurance instead of the FortiToken logo.

The platform's main use case is to facilitate authentication when connecting outside of the organization, particularly when using Fortinet VPN. It ensures secure access to our network resources, especially when working remotely.

The primary benefit of using FortiToken is its cost-effectiveness. It provides a reliable authentication solution without requiring significant financial investment.

One of the product's most valuable features is its ease of use. The soft token offering simplifies the authentication process, making it convenient for users. Additionally, its straightforward installation and configuration contribute to its value.

They could enhance synchronization with mobile applications, and addressing minor issues with authentication could further improve user experience.

I've been using FortiToken for about three years now.

I rate the product stability an eight out of ten. While it's generally reliable, there have been occasional instances where multiple authentication attempts were required.

Approximately 200 users are currently using FortiToken within our organization. It is scalable, and additional licenses can be easily acquired to accommodate more users as our organization grows.

The initial setup was straightforward. Onboarding and initial testing typically take about a day before the system is fully operational within our organization.

The platform's licensing cost is reasonable for our organization. We opted for a yearly subscription, which aligns well with our budgetary requirements.

FortiToken is integrated with our FortiFirewall and FortiWeb systems. This integration enhances security, especially when employees access organizational resources remotely, such as working from home.

I advise others to consider using the product to explore its token offering for simplified authentication.

I rate it a ten overall. It meets our authentication needs effectively and is a valuable asset to our organization's security infrastructure.

We only use FortiToken for authentication purposes, like logging into SSL VPN or plugging into firewalls.

I like how easy it is to configure and assign tokens. It's readily available through our application-based system.

The problem comes when we have to migrate tokens to new phones. There's no backup option or import/export feature, so you have to redo the entire process manually, adding tokens one by one, which is quite tedious.

The migration process is definitely a major area for improvement. Imagine losing your phone and having to set everything up again from scratch and add everything individually.  

In future releases, push notifications would be good! Instead of opening the app and entering the token manually, what if we received an approval or denial prompt directly on the phone as a notification? Just a tap to log in, that would be nice.

I have been using it for three years now. 

I would rate the stability a nine out of ten. It's been very reliable for my customers. 

I would rate the scalability a seven out of ten. The migration issue definitely brings it down a bit.

Moreover, if FortiToken could improve that, maybe introduce push notifications or even eliminate the need for manually entering token keys, it could easily reach a ten out of ten.

Replacing the token key entry with a simple notification and selection option to accept/deny would be very handy and useful. Now, we have to scroll down and search for the correct FortiToken by name. 

I recommend FortiToken for all companies, especially when they connect to sensitive servers. That's why I suggest them to use it.

There haven't been any emergencies, but the response times and everything were good when I needed help.

Positive

Before FortiToken, I used Okta for authentication. For firewalls and network devices specifically, I recommend FortiToken.

The initial setup is easy. You receive a QR code via email, scan it, and add it. No complicated procedures involved.

The deployment model depends on the customers. We have different customer setups, but most are on-premises, device-based deployments.

We typically require our assistance with deployment. We manage their hardware and infrastructure, so deployment falls under our responsibility.

The pricing is not very high, so I'd rate it around six out of ten, where one is high and ten is low.

I can compare it with Microsoft's 365 authentication or other Microsoft authentication solutions, but they have different features.

Overall, I would rate the solution an eight out of ten. I recommend FortiToken to all our clients who purchase Fortinet devices, especially within banking and payment systems.