Troubleshooting Tip: Token code required even when two-factor is disabled in user settings

Description

This article describes how to troubleshoot when FortiClient is still prompting for a token code during connection to SSLVPN or Dialup IPSEC VPN, even when the user has no token assigned or enabled two-factor authentication.

Scope

FortiGate.

Solution

Overview 

Checking on the user settings, there is no two-factor authentication setting enabled : 

config user local
    edit "guest"
        set type ldap
        set ldap-server "LDAP Server"
    next
end

However upon connecting, the FortiClient would still show the token code prompt: 

To investigate further, run the authentication debug on the FortiGate using the following commands : 

diagnose debug reset
diagnose debug application fnbamd -1
diagnose debug application ike -1
diagnose debug console timestamp enable
diagnose debug enable

The following example log is shown for authentication debug: fnbamd daemon detected that a token is required.

2026-06-15 20:44:29 [2589] fnbamd_ldap_result-Passed group matching
2026-06-15 20:44:29 [916] update_auth_token_session-Token is needed
2026-06-15 20:44:29 [778] auth_token_push-

The following example log is shown if IKE debug is enabled: XAuth result will show token is required.

2026-06-15 20:44:29.924605 ike V=root:0:IPSec_0:557870: XAUTH 12562867404925 result FNBAM_NEED_TOKEN
2026-06-15 20:44:29.924716 ike V=root:0:IPSec_0: XAUTH requires token for user "guest"
2026-06-15 20:44:29.924731 ike V=root:0:IPSec_0:557870: sending XAUTH token request

Solution:

Check on the global settings: In this problem, it was due to the fact that this global setting is set to 'mandatory'.

config system global
	set multi-factor-authentication mandatory
end

Make sure this is set to 'optional' so that it does not enforce multi-factor authentication globally.

The default value for this setting is optional.

config system global
	set multi-factor-authentication optional
end