An administrator needs to configure VPN user access for multiple sites using the same soft FortiToken. Each site has a FortiGate VPN gateway. What must an administrator do to achieve this objective?

A FortiToken is generally registered locally to a specific FortiGate for authentication and cannot be simultaneously registered or synchronized across multiple standalone FortiGate devices without a centralized system.

A FortiAuthenticator device acts as a centralized RADIUS server, allowing FortiTokens to be managed and synchronized across multiple FortiGate devices. This ensures that a user's single FortiToken can be used for authentication on any FortiGate connected to the FortiAuthenticator, facilitating multi-site VPN access with the same token.

While a third-party RADIUS OTP server can provide multi-factor authentication, it does not manage or provision FortiTokens, which are proprietary to Fortinet, making it unsuitable for using FortiTokens across multiple sites directly.

The user self-registration server is primarily for guest or initial user account provisioning and does not provide the capability to synchronize FortiTokens for VPN access across multiple FortiGate devices.