Technical Tip: 'policy-auth-concurrent' system global command clarified

Description

This article explains the 'policy-auth-concurrent' configuration parameter and clarifies its default value.

Scope

FortiGate.

Solution

The option 'policy-auth-concurrent' under the system global profile is used to control if the same user can be authenticated for multiple sources at the same time.

config system global
    set policy-auth-concurrent (0-100)
end

The default value for this setting is '0', meaning there is no limit to the number of source IP addresses that can be associated with a single user.

If this value is modified, captive portal and firewall policy authentication prevent a user from authenticating from additional IP addresses once the limit is reached, and display a browser warning.

For example, if policy-auth-concurrent is set to '1', each user can only be associated with one source IP address at a time. If a user has already been authenticated, future authentication requests for the same user from other source IP addresses will be denied.

config system global
    set policy-auth-concurrent 1
end

The 'policy-auth-concurrent' setting can be overridden at the user group or user level. When configured at the user or group level, 'auth-concurrent-value' will have precedence over the global 'policy-auth-concurrent' setting.

config user local
    edit <name>
        set auth-concurrent-override enable
        set auth-concurrent-value (1-100)
end

config user group
    edit "fortilab_exchange"
        set auth-concurrent-override enable
        set auth-concurrent-value (1-100)

end

Notes:

• The priority of the auth-concurrent setting is User group -> User -> Global setting.
• The auth-concurrent setting applies per VDOM.
• Auth-concurrent setting only applies to firewall policy authentication and captive portal authentication users. It does not apply to VPN users or firewall administrators.
  • IPsec VPN does not permit limiting the number of concurrent connections from the same user; see this article: Technical Tip: IPsec Remote access VPN permits multiple connections from the same user..
  • SSL VPN does permit limiting users to one VPN connection at a time, see this article: Technical Tip: Multiple sessions of SSL VPN users.