Technical Tip: Increasing email Token expiry time

Description

This article describes how to increase email Token expiry time via CLI. In some cases due to email delays, users cannot log in due to the token code expiry.

'remoteauthtimeout' does not control 2FA code validity directly but affects the overall login process for remote user backends like LDAP, RADIUS or TACACS.

'remoteauthtimeout' command will override the two-factor-email-expiry, so increase both timers. The mentioned value is in seconds.

This timer is not correctly applied in some of the latest versions (v7.2.10+, v7.4.5+, v7.6.1+) when using IPsec (IKEv2) Remote Access VPN. This is a known issue, tracked under bug 1087651, which has been addressed in v7.6.3 and v7.4.8.

Scope

FortiGate.

Solution

Use the following sample setting to extend the timer to 5 minutes:

config system global
    set two-factor-email-expiry 300
    set remoteauthtimeout 300
end

Here, 'two-factor-email-expiry' defines how long the 2FA code (email-based token) remains valid, in seconds, and 'remoteauthtimeout' defines how long FortiGate waits for the remote authentication server (RADIUS/LDAP/SAML/etc) to respond before timing out.

Note: However, if it is used in a mixed environment or uses other methods, it is recommended to consider using these commands under 'config system global':

• set two-factor-ftm-expiry <seconds>: For FortiToken Mobile on FortiGate.
• set two-factor-sms-expiry <seconds>: For tokens via SMS, when FortiGate sends an SMS.
• set two-factor-fac-expiry <seconds>: For tokens challenges by the FortiAuthenticator as RADIUS server.