Fortinet FortiToken-400 User manual

QuickStart Guide
FIDO is an evolution of user authentication for online access. It is also known as passwordless authentication. FIDO is an open standard
that was developed by the FIDO Alliance and the World Wide Web Consortium. FIDO is a lightweight approach to asymmetric public-key
cryptography that extends the security benefits of public-key cryptography to a wider array of applications, domains, and devices. FIDO is
designed to reduce (or remove) password usage, to avoid the sharing of secrets, and to create a path toward using a single credential for
authenticating to multiple service providers such as websites and mobile services.
FortiToken-400
FortiToken 400 is our all-in-one USB security key that can be used for multi-factor
authentication (MFA) or passwordless login when using online services, device
login (such as FortiGate), or network (such as VPN/ZTNA). FortiToken 400
supports FIDO U2F and FIDO2 protocols. It reduces reliance on passwords while
increasing security and protecting user privacy. FIDO2 eliminates passwords
entirely. During the authentication process, you will see the blinking green LED on
your security key, simply enter your PIN associated with the key and press the
button to sign in.
What is Fast IDentity Online or FIDO?
Package Contents
Your package contains the following:
•FortiToken 400 Unit(s)
•FortiToken-400 Quick Start Guide
PIN Management for FTK-400
Windows:
You can manage the PIN on your FortiToken-400 Security Key through your Windows 10 account settings
1. To set up the PIN, please use Windows 10 with the latest update, and type Sign-In options in the left-bottom search bar
2. Click on Security Key > Manage
3. Follow the on screen instructions to setup the PIN for your security key
4. You can follow the same steps to change/reset your PIN
macOS/Linux:
You can manage the PIN on your FotiToken-400 directly in Chrome browser if you're on macOS or Linux
1. In Chrome browser, click on the three dots next to your profile, then click Settings.
2. On the sidebar menu, click Privacy and security. Under Privacy and Security, click Security, then click Manage security
keys.
3. Follow the on screen instructions to setup the PIN for your security key
4. You can follow the same steps to change/reset your PIN

4. Now select FortiToken section to manage your multi-factor settings
3. Login to the portal by providing your username and password
5. Click on Add FIDO Key under MFA Registration section
6. Provide appropriate name to your new FIDO key
•Admin has enabled FIDO for individual users
•FAC Self-Service portal as been enabled with FIDO registration
Note: Please refer to the FortiAuthenticator admin guide for further details.
Steps to be performed by end user:
FIDO Security Key (FTK - 400) Self Registration on FortiAuthenticator (FAC)
Pre-requisites:
1. Obtain a FIDO KEY
2. Access FAC Self Service Portal from your browser

7. Click OK on the security popup box which grants permission
8. When prompted, insert your security key and press the button when it's blinking
9. If prompted again, click OK to continue
10. On Windows machine, you may get a popup for a security key PIN. Please insert your Windows
PIN number to proceed
11.11. You have successfully registered your FIDO key and you can see it under Manage your FIDO keys menu.

Visit these links for more information and documentation for your Fortinet product:
• Technical Documentation: http://docs.fortinet.com
• Knowledge Base: http://kb.fortinet.com
• Technical Support: https://support.fortinet.com
• Training Services: http://training.fortinet.com
© Copyright 2022 Fortinet Incorporated. All rights reserved.
Products mentioned in this document are trademarks or registered trade-
marks of their respective holders.
Regulatory Compliance: FCC Class A Part 15, / CE Mark
April 20, 2022
33-000-777120-20220420
General Information
•You are not required to enter a PIN for google accounts because google accounts only use U2F for
authentication which does not need a PIN.
•You may use the Windows Sign-on options to set a PIN value other than “888888” and try again, it should
respond with a PIN error when a PIN is required.