Troubleshooting Tip: Unable to connect dial-up IPsec VPN IKEv2 with local user due to 'Max session number reached'

Description

This article describes an issue where, when the Local user tries to connect to dialup IPsec VPN IKEV2, it fails to connect with a 'Wrong Credentials EAP' error on FortiClient. The IKE debug logs show the error 'Max session number reached'.

Scope

FortiGate 7.4, 7.6.

Solution

When the the Local user tries to connect to the IPsec VPN IKEV2, the connection fails with the error on FortiClient showing 'Wrong Credentials EAP'.

The IKE debug logs show the following error:

handle_req-Max session number reached

To run the IKE debugs:

diagnose debug reset
diagnose debug reset
diagnose vpn ike log filter dst-addr4 <Forticlient public ip-address>
diagnose debug application ike -1
diagnose debug application fnbamd -1
diagnose debug application eap_proxy -1
diagnose debug console timestamp enable
diagnose debug enable

The output shows: 

2026-05-03 13:05:52 [1781] handle_req-Max session number reached
2026-05-03 13:05:52 [279] fnbamd_comm_send_result-Sending result 11 (nid 0) for req 1237215501084, len=2600
wpad_fnbam_read() -- got response
process_auth_result 918 -- ses_id=1237215501084, currentMethod=26, auth_res=11.
eap_comm_send_auth_result 299 rsp len:928
ep_auth_session_del 154 -- auth session deleted, ses_id=1237215501084
2026-05-03 13:05:52 1777827952.096265: 2026-05-03 13:05:52 eap_comm_client_read:724, type:0, size:928
2026-05-03 13:05:52 1777827952.096338: 2026-05-03 13:05:52 EAP-MSCHAPV2: Invalid NT-Response
2026-05-03 13:05:52 1777827952.096379: 2026-05-03 13:05:52 EAP: EAP entering state METHOD_REQUEST
2026-05-03 13:05:52 1777827952.096418: 2026-05-03 13:05:52 EAP: building EAP-Request: Identifier 13
2026-05-03 13:05:52 1777827952.096457: 2026-05-03 13:05:52 EAP-MSCHAPV2: Failure Request Message - hexdump_ascii(len=57):

Checking fnbamd sessions with the following command shows lot of sessions are in a pending state:

diagnose test application fnbamd 1

The output shows the following:

Total fnbam requests in caller side: 0; EAGAIN errors: 0; other errors: 0
Pending sessions: 1023
Max session reached: 726
Res 0: 16181
Res 1: 1131
Res 2: 5700
Res 3: 0
Res 4: 0
Res 5: 381
Res 6: 0
Res 7: 2140
Res 8: 0
Res 9: 0
Res 10: 254
Res 11: 726
Res 12: 1
Auth:
requests: 6372
sessions: 4702
released: 4689
Acct:
requests: 1
sessions: 0
released: 1
Cert:
requests: 14543
sessions: 14477
released: 14477
LDAP stats:
total: 0
conn failures: 0

This issue happens due to fnbamd getting stuck and the IPsec VPN Connection failure occurs when maximum session limit is reached with EAP enabled in IKE config with 2FA for Local users.

This is a known issue in 7.4 and 7.6 FortiOS version with ID number 1263865 and is fixed in 7.4.13, 7.6.7 and also in 8.0.0 version. 

The workaround is to either disable 2FA for the Local user:

config user local
    edit "<username>"
        set two-factor disable
    next
end

Or to disable EAP authentication in IKE by changing the IPsec VPN IKE version from 2 to 1:

config vpn ipsec phase1-interface
    edit "<name_of_the_tunnel>"
        set ike-version 1
    next
end

Or to restart the fnbamd process using the command below:

fnsysctl killall fnbamd