Adding MFA to FortiGate should be straightforward. FortiGate is already on your network. Fortinet has its own MFA products — FortiToken Mobile and FortiToken 200 hardware — that integrate natively. No third-party tools, no RADIUS proxy, no extra infrastructure. That’s the pitch. The reality, for many organizations, is that native FortiToken licensing scales less predictably than expected — and FortiAuthenticator, Fortinet’s centralized token management appliance, adds a separate infrastructure cost that isn’t always visible at the point of the initial FortiGate purchase. This article breaks down what Fortinet MFA actually costs, how the licensing model works, and what the numbers look like for a 100-user organization choosing between native FortiToken and a third-party RADIUS MFA approach. What the Fortinet Native MFA Stack Looks Like Fortinet’s MFA ecosystem has three components that typically come up in a FortiGate MFA conversation: FortiToken Mobile is a software OTP application for iOS, Android, and Windows devices. It’s OATH-compliant and time-based (TOTP). The key operational detail: FortiToken Mobile licenses are sold as perpetual licenses registered to a specific FortiGate appliance (for licenses issued after August 2025). A license for 100 users is tied to that one FortiGate — not to your organization or your user directory. FortiToken 200 / 200CD is Fortinet’s hardware OTP token — a small keychain device that generates a 6-digit code every 60 seconds. The 200CD variant ships with an encrypted activation CD for seed security. These are also perpetual, per-unit licenses, tied to the appliance they’re activated on. Note: the FortiToken 200B has been discontinued; current hardware token offerings are the FortiToken 210, 310, and 410 series. FortiAuthenticator is a dedicated appliance (physical or virtual) that centralizes FortiToken management across multiple FortiGate units. Without FortiAuthenticator, each FortiGate handles its own token pool independently — licenses registered to FortiGate-A cannot be used by FortiGate-B. FortiToken Mobile Pricing: What 100 Users Actually Costs FortiToken Mobile licenses are available in fixed user-count bundles. Based on publicly available pricing from authorized resellers (list price, USD): BundleUsers coveredList pricePer-user costFTM-ELIC-1010$958~$96/userFTM-ELIC-2525$2,246~$90/userFTM-ELIC-5050$4,178~$84/userFTM-ELIC-100100$7,638~$76/userFTM-ELIC-200200$13,787~$69/user Source: AVFirewalls.com (authorized Fortinet reseller), list prices as of 2025. Actual prices vary by reseller and region. For 100 users on a single FortiGate, the list price is $7,638 — a one-time perpetual license. That number looks reasonable until you factor in what it doesn’t include. What it doesn’t include: The license is tied...