Technical Tip: SSL VPN Auth with FortiClient does not trigger FortiToken push after the upgrade

Description

This article describes an issue encountered when upgrading to FortiAuthenticator v8.0.2.

Scope

FortiAuthenticator.

Solution

Before the upgrade, SSL VPN authentication using push notifications worked as expected. After entering their username and password, end users were prompted for the token. Once the push notification was accepted, authentication completed successfully.

After upgrading FortiAuthenticator to version 8.0.2, end users enter their username and password, and the token field appears briefly for a few seconds and then disappears. As a result, users do not have the possibility to enter the token manually.

From the RADIUS debug logs, the following errors can be observed when attempting to authenticate users:

2026-04-06T08:19:55.261687+00:00 fortiauth radiusd[1685]: (313416) facauth: ===>Username:pirlo
[...]
2026-04-06T08:19:55.262608+00:00 fortiauth radiusd[1685]: (313416) mschap: ERROR: Failed generating NT-Password - Password is missing or is empty
2026-04-06T08:19:55.262629+00:00 fortiauth radiusd[1685]: (313416) facauth: # Executing group from file /usr/etc/raddb/sites-enabled/default
2026-04-06T08:19:55.262691+00:00 fortiauth radiusd[1685]: (313416) mschap: ERROR: MS-CHAP2-Response is incorrect
2026-04-06T08:19:55.262923+00:00 fortiauth radiusd[1685]: (313416) facauth: Request contains token code
2026-04-06T08:19:55.262934+00:00 fortiauth radiusd[1685]: (313416) facauth: Proceed to authenticate token code
2026-04-06T08:19:55.262958+00:00 fortiauth radiusd[1685]: (313416) facauth: Successfully found partially authenticated user instance.
[...]
2026-04-06T08:19:55.264465+00:00 fortiauth radiusd[1685]: (313416) mschap: ERROR: MS-CHAP2-Response is incorrect
2026-04-06T08:19:55.264549+00:00 fortiauth radiusd[1685]: (313416) facauth: # Executing group from file /usr/etc/raddb/sites-enabled/default
2026-04-06T08:19:55.264636+00:00 fortiauth radiusd[1685]: (313416) mschap: ERROR: MS-CHAP2-Response is incorrect

Workaround: Disabling push notification on RADIUS policies resolves the issue.

This is a known issue tracked under Engineering Ticket 1279437.

The issue is resolved in FortiAuthenticator version 8.0.3. Release notes can be found here: Release Notes.