Hi everyone. I'm helping our small team (about 20 people) set up a FortiGate VPN for remote work. We're currently just using the built-in user groups for SSL-VPN access, which is fine, but I've heard about FortiAuthenticator.
Can someone explain the main practical differences? I'm especially curious about:
When does the extra complexity of a separate FortiAuthenticator become worth it? Is it mostly for larger organizations, or are there specific features (like better 2FA management or guest portals) that are a game-changer even for a team our size?
Our main goal is security that's simple for the team to use. Right now, managing users directly on the FortiGate feels a bit clunky.
I'm BillyJ, a systems engineer at a healthcare SaaS company of about 300 users. We've run FortiGate VPNs for years, first using local user groups, then switching to FortiAuthenticator (FAC) across all 60-series firewalls for about 800 remote and clinic users.
Here's a concrete breakdown of the practical differences:
1. **Administrative Overhead:** Local users become unmanageable surprisingly fast. With 20 users, you're adding, editing, and removing users manually via CLI or the GUI. FortiAuthenticator centralizes this. You connect it to Active Directory or LDAP, and user management is done there. For a team of 20, the initial setup might be 4-6 hours, but it eliminates per-user config on the firewall. I'd guess we spent 30 minutes a week on VPN user tasks before FAC; now it's maybe 30 minutes a quarter.
2. **Two-Factor Authentication (2FA) Management:** This is the game-changer, even for a small team. Built-in FortiGate 2FA means managing tokens per user on the firewall itself. If someone loses their token, you're reconfiguring on the FortiGate. FAC becomes your central 2FA server. You can push mobile tokens via email, use hardware tokens, or integrate with broader MFA systems. The policy and enforcement (like requiring 2FA only from external networks) are far more granular. Managing 2FA for 20 users on the FortiGate is clunky; on FAC, it's a unified console.
3. **Guest and Sponsored Access:** If you ever need to give contractors or temporary workers VPN access, the built-in method is a security risk - you're creating a permanent local account until you remember to delete it. FAC provides guest portals and sponsored access workflows where access can be time-bound and approved via email, automatically expiring. For a small team, this is a major security upgrade if you have any transient users.
4. **Cost vs. Complexity:** The biggest cost isn't the FAC VM license (which for 20 users is a minimal annual subscription). It's the operational overhead of maintaining *another* server. You need to patch it, back it up, monitor it, and ensure its HA if you rely on it. For 20 users, that's a real consideration. The built-in method has zero additional infrastructure cost. The FAC's value scales directly with user count, MFA requirements, and the frequency of user changes.
My pick: For a team of 20 with a primary goal of "security that's simple for the team to use," I'd actually stick with the FortiGate's built-in user groups *if* your team rarely changes and you don't need advanced 2FA or guest access. The complexity jump is real. If you anticipate growth beyond 30-40 users, or if you have strict 2FA requirements or frequent guest users, implement the FortiAuthenticator now. To make the call clean, tell us how often your user list changes monthly, and whether you currently use or plan to mandate two-factor for all VPN logins.