Technical Tip: Stop FortiClient from attempting AutoConnect when there is Always-Up + auth-timeout setup from FortiGate

VPN setup summary:

• Configure 'auth-timeout' on FortiGate (VPN tunnel will be dropped after the configured duration).
• Configure [Auto Connect Only When Off-Fabric] + [Always-Up VPN] + [Always Up Max Tries = 3] + <keep_running>1 in FortiClient EMS endpoint profile.

In this example, auth-timeout on FortiGate is set to 43200 (12 hours), meaning the user can only be connected up to 12 hours per VPN session, regardless of whether or not the user is actively using the VPN tunnel.

This configuration is useful when an organization has the following requirements:

• End users must always connect to VPN when in off-fabric (eg, out-of-office, not physically located in the company).
• End users must reauthenticate every 12 hours to continue using VPN for security reasons.

Issue description:

• After the VPN is connected for 12 hours, the VPN tunnel will be dropped from the FortiGate side. However, FortiClient keeps attempting AutoConnect (as it is configured as such).
• FortiClient did not respect the [Always Up Max Tries = 3] configuration; it keeps attempting AutoConnect until it succeeds.
• This can be an issue when the VPN tunnel is a SAML VPN with MFA authentication.
• If the user is away or not in front of the computer after the VPN disconnection, it causes the MFA token to be sent to the end user's mobile phone.

• It may also result in Entra ID blocking the user account if there are such security policies applied on the Entra ID side.

This behavior is due to the (Always Up Max Tries = 3) configuration is not applicable in the (Auto Connect Only When Off-Fabric) scenario.

Solution:

1. In FortiClient EMS, enable the on/off-fabric profile.

2. In the on-fabric profile, do not configure any Auto Connect.

3. In the off-fabric profile:

• Set [Disable Internet Check] to OFF.
• Configure the desired [Auto Connect] tunnel.
• Set [Auto Connect Only When Off-Fabric] to ON.
• Set [Always Up Max Tries] to a desired value (eg, 3).

With this configuration, the expected results:

1. After the VPN is connected for the auth-timeout duration (eg, 12 hours), the VPN tunnel will be dropped from the FortiGate side.
2. FortiClient determines the endpoint fabric status.

• If it is on-fabric, FortiClient will not autoconnect.
• If it is off-fabric, FortiClient will attempt to AutoConnect. It will stop the AutoConnect attempt after 3 tries.

3. As such, when the user is away or not in front of the computer, the MFA token will not be sent to the end user's mobile phone.
4. FortiClient will still attempt AutoConnect when there is a brief VPN disconnection due to network hiccups on the end user side.