Technical Tip: Admin idle timeout with multiple browser tabs

Description

This article describes the issue of the admin idle timeout causing all browser tabs to log out, even if one tab is actively being used.

Scope

FortiGate.

Solution

When an administrator logs in from the first browser tab, a session cookie is set.

Browsers share cookies across all windows/tabs of the same browser profile.

An administrator is actively working on the FortiGate GUI with one of the browser tabs, but the other browser tabs to the same FortiGate are idle and eventually hit the timeout limit. As a result, the FortiGate will then log out all browser tabs based on that single shared cookie.

There are some options to work around this behavior, but ultimately this constitutes normal browser behavior and is not a FortiOS limitation. 

Option 1 :

Use different browsers (e.g., Chrome and Firefox).

Use different Chrome profiles (chrome://settings/manageProfile).

Use Chrome's Incognito mode for the second session.

Option 2 :

Increase the admin idle timeout to a suitable value. The default value is 5 minutes.

config system global
    set admintimeout <1-480 minutes> 
end

Refer to:

Technical Tip: How to configure administrator-specific idle-timeout settings on FortiGate

Option 3 :

Configure an admin account with no timeout limit.

Refer to:

Technical Tip: Configure FortiGate administrative access to never timeout