SonicOS/X API Reference Guide

Download PDF
Technical Documentation > SonicOS/X API Reference Guide > API Authentication > Two-Factor Authentication

Two-Factor Authentication

SonicOS API supports Two Factor Authentication (TFA) for administrators and users who want to enable the security feature from the Graphical User Interface (GUI) and API. This is an alternative to the other authentication mechanisms described here and cannot be used along with those. Bearer Token Authentication is an alternative method of securing the management requests sent after authentication, as per the Open API Specification, and as used by Swagger. When two-factor authentication is used to log in on the API, then Bearer Token Authentication must be used in all the requests that follow it.

To log in with TFA and use Bearer Token Authentication through the firewall

  1. Enter your Username and Password in the SonicWall LOG IN page.

  2. Navigate to MANAGE | System Setup | Appliance > Base Settings.

  3. Under the Administrator Name & Password section, scroll down to One-time Passwords Method:

  4. Choose TOTP from the drop-down menu.

  5. Scroll down to the SonicOS API section.

  6. Select Enable Two-Factor and Bearer Token Authentication (applies to built-in admin and local user with TOTP only, post sonicos/tfa directly instead of sonicos/auth).

  7. Click ACCEPT.

    A message displays under the ACCEPT and CANCEL buttons next to Status indicating the configuration has been updated.

To use TFA and Bearer Token Authentication

  1. Enter your Username and Password in the SonicWall LOG IN page.

  2. The SonicWall-proprietary bar code screen displays.

  3. Install either the Google Authenticator or Duo apps on your phone to implement two-step verification using TOTP for your appliance.

  4. Using the apps, scan the SonicWall bar code by positioning your phone lens window in front of the bar code.

  5. The apps then generate a security code that you enter into the text field next to 2FA Code:

    Remember to write down your eight-digit emergency scratch code somewhere for later access as it is the only way to log in if you lose your mobile phone.

  6. Click OK.

  7. Click the Click here to continue ... link in the next SonicWall bar code screen after you have succeeded to UNBIND the TOTP KEY.

  8. Enter the code from the app in the 2FA Code field and click OK.

  9. After your password has been verified you successfully land in the appliance’s Base Settings page.

    Administrators and users can also enforce the TFA and Bearer Token Authentication feature by going to System Setup | Users > Settings page.

To log in with TFA and use Bearer Token Authentication through the API

  1. Navigate to MANAGE | Logs & Reporting | API.

  2. Click on the HTTPS://SONICOS-API.SONICWALL.COM link under the SonicWall SonicOS API Agreement section.

  3. Click Logout to log out of the firewall.

  4. The browser automatically links to the SWAGGER API open-source software user interface, which displays. You can also use other API tools such as Postman and Linux Command cURL.

    The Swagger tool works slowly sometimes so it may take a few seconds for the UI to appear. Also, not all browsers have the same speed of connection to Swagger and the other API apps.

  5. Post “tfa” with user name, password, and two-factor code to the firewall.

  6. Click Execute.

  7. Click Authorize when done.

  8. The bearer token is returned in the “tfa” response message.

  9. Click Authorize.

  10. Click Authorize again under Available authorizations.

Was This Article Helpful?

Help us to improve our support portal

Yes! Not Really

Techdocs Article Helpful form

  • Hidden
  • Hidden

Techdocs Article NOT Helpful form

  • Still can't find what you're looking for? Try our knowledge base or ask our community for more help.
  • Hidden
  • Hidden