Technical Tip: TACACS+ and LDAP-proxy authentication stopped working after upgrading to FortiOS v7.4.4

Starting FortiOS v7.4.4, a few changes were made in the fnbamd process that handles the authentication on the FortiGate against a remote server.

One of the changes resulted in enforced certificate validation for LDAPS connections, requiring admins to upload the LDAPS server’s CA certificate to the FortiGate.

See the following KB article for more information:

Technical Tip: LDAPS connections no longer work after update to v7.4.4

Another change was with the ldapconntimeout setting and what it controlled. Originally, this setting only controlled the timeout used when measuring LDAP TCP session setup, but as of FortiOS v7.4.4, it now also measures the length of time for packet read/write by the fnbamd process.

This is because ldapconntimeout has a very short default value of 500ms, and this can potentially cause issues in the following scenarios:

• If there are unexpected/random delays with the TACACS+ or LDAPS server that result in communication exceeding the 500ms timeout. For TACACS+, it can be validated by collecting the output of the debug command 'diagnose debug application fnbamd -1' shows TACACS+ reachability timed out.
  
  

2024-06-03 08:11:44 [505] __tac_plus_conn_timeout-Connction withTACACS_SERVER:1.2.3.4 timed out. --> The packet capture indicates that the TACACS+ reply was reached after the FIN packet was sent from FortiGate.

• If the client uses Multi-Factor Authentication (MFA) with ldap-proxy then 500ms may not be sufficient (since users need to respond to MFA push notifications).
• Note: for an SSL VPN and an IPsec VPN may be applied additional timeout values (remoteauthtimeout and eap_proxy timeout may be applied (synced starting FortiOS v7.4.8, and v7.6.3). 

To work around this issue, for LDAPS or TACACS+, change the ldapconntimeout to 2000ms or greater. If LDAP-proxy on the FortiGate is configured, then change ldapconntimeout to a similar value as remoteauthtimeout using the below commands:

config sys global

    set ldapconntimeout <time-in-milliseconds>

end

This new ldapconntimeout value will help to account for any delays with LDAPS or TACACS+ packets, and it will also provide users with enough time to respond to multi-factor push notifications when using LDAP-proxy with MFA.

This issue has been resolved in FortiOS versions 7.4.5 and 7.6.1.