Technical Tip: FortiToken troubleshooting on FortiAuthenticator
Description
This article provides a guide on how to troubleshoot FortiToken-related issues on FortiAuthenticator.
Scope
FortiAuthenticator.
Solution
FortiAuthenticator can assign FortiTokens to users to provide multi-factor authentication (MFA). There can be issues with adding tokens to FortiAuthenticator, assigning tokens to users, or with token codes or push notification.
Check connectivity with FortiGuard servers:
The following commands can executed on FortiAuthenticator CLI to verify if FortiAuthenticator can access the FortiGuard servers.
execute ping fds1.fortinet.com <- to check the license validation updates
execute ping directregistration.fortinet.com <- to check if Fortinet registration services can be reached
execute ping fortitokenmobile.fortinet.com <- To check the connectivity to the services used for Token activation/sync)
Check Token Status and Type:
The Tokens can be viewed under Authentication -> User Management -> FortiTokens.
There are two types of tokens: Mobile, and Hardware. They can be distinguished by serial number; mobile tokens begin with 'FTKMOBxxxx', whereas hardware tokens begin with 'FTKxxxx', and then a number that denotes the particular hardware series (200, 211, 300, etc). Mobile tokens list what license they belong to; the trial tokens available on FortiAuthenticator have a license serial beginning with 'FTMTRIALxxxx'.
Tokens are usually in one of three states on FortiAuthenticator:
- 'Available' - the token is currently unassigned and available to be assigned
- 'Assigned' - the token has already been assigned and activated, ready to be used
- 'Pending' - the token is provisionally assigned to a user, but must be activated by said user. Only applies to mobile tokens, and the token can still be used while in Pending status.
- Any other status denotes some kind of error.
Steps to perform if issues are encountered with adding tokens to FortiAuthenticator:
- Check if the FortiToken license number is bound to the correct FortiAuthenticator serial number. This is visible under the support account on the FortiAuthenticator Asset, in the section License & Key.
- If the FortiAuthenticator is part of an HA cluster, the tokens can only be registered/activated on the primary. All hardware tokens and mobile token licenses need to be bound to the primary's serial number.
Note: FortiToken Mobile licenses cannot be transferred between different devices if the license has been shipped after August 4, 2025, excepting RMA replacements. More information may be found here: Technical Tip: FortiToken Mobile will no longer support License Transfer between different devices
Note: The tokens that have the same license number shown on the table means all those tokens belong to the same FortiToken mobile license. The same license can be used to re-import those tokens back to FortiAuthenticator if any or all are deleted. FortiAuthenticator allows for applying a mobile token license again even if tokens from this license are already/still present on FortiAuthenticator. It is not required to delete all tokens of a license before reapplying the license.
Steps to perform in the event of issues with token usage:
- Remove the current FortiToken from user, then assign another (and activate if if mobile token) in the user account settings. Verify the token status is 'Activated'.
- Delete the affected token and add it back to FortiAuthenticator. Hardware tokens can be added back simply by creating a new hardware token and specifying the token serial number. Mobile tokens can be added back by specifying the related mobile token license serial. The license serial number is visible in the 'FTM license' column under Authentication -> User Management -> FortiTokens.
Further Troubleshooting:
If none of above options helped then the following logs can be collected and provided to the Fortinet TAC Support through the ticket:
- Enable detailed debug through https://FAC_IP/debug/ and going to the section RADIUS Authentication, then select 'Enter Debug Mode -> Enter detailed debug mode'.
- Reproduce the issue .
- After steps 1 and 2, go to GUI -> Logging -> Log Access -> Logs -> Downloads and download the following and attach to the ticket:
- Raw.
- System.
- GUI.
- Summary.
- Rest API.
Note: The tested/affected username, test timestamp, affected token number(s) should be provided through ticket as well.
The logs and details should be provided to the Fortinet TAC Support through a support case for further investigation.
Related articles:
