Troubleshooting Tip: Adjusting directory synchronization timeout

Description

This article describes how to change the timeout limit for LDAP synchronization.

Default Timeout Limits:

FortiNAC-F v7.6.6.0900 (GA) and below: 15 minutes.

Later releases: 53 Minutes.

However, this time increase may not be sufficient for some larger environments.

Scope

FortiNAC versions F 7.6.6.6081 (hotfix) and F 7.6.7 +.

Solution

Note: This process requires a restart of FortiNAC services to apply changes. If the network is under FortiNAC enforcement, consider scheduling a maintenance window.

Procedure:

1. Ensure FortiNAC has been upgraded to a supported version before proceeding (see Scope).

2. Determine the appropriate timeout setting based on how long it takes to complete the directory synchronization. This may require setting the value to a very high number, confirming how long the synchronization takes, then modifying the value to a smaller number as appropriate. 

3. From the FortiNAC CLI, edit /bsc/campusMgr/master_loader/.masterPropertyFile.

4. Add the following lines, and note down the values for DirectorySync.synctimelimit and DirectoryPerformTask.timeout as they should match.

  FILE_NAME=./properties_plugin/DirectorySync.properties
{
      com.bsc.plugin.ldap.DirectorySync.synctimelimit= $value_in_ms
  }
  FILE_NAME=./properties_plugin/directoryPerformTask.properties
  {
      com.bsc.plugin.ldap.DirectoryPerformTask.timeout= $same_value_in_ms
  }

Example: 

#############################################################
# FILE_NAME=./properties_plugin/bridgeManager.properties
# {
# com.bsc.plugin.bridge.BridgeManager.verifyRegisterdClients=true
# }
#############################################################
  FILE_NAME=./properties_plugin/DirectorySync.properties
  {
      com.bsc.plugin.ldap.DirectorySync.synctimelimit=99000000
  }
  FILE_NAME=./properties_plugin/directoryPerformTask.properties
  {
      com.bsc.plugin.ldap.DirectoryPerformTask.timeout=99000000
  }

5. Restart FortiNAC services to apply changes.
   
   

execute service restart nac

6. Log in to the FortiNAC UI.

7. Go to Events & Alarms -> Management. Ensure both 'Directory Synchronization Success' and 'Directory Synchronization Failure' are enabled. See this document, Event Management in the Administration Guide, for setting options.

8. Test it by running the 'Synchronize Users from Directory' task under System -> Scheduler.

9. Go to Events & Alarms -> Events and select Update to refresh the view. If the task is completed successfully, the event 'Directory Synchronization Success' should be generated. Otherwise, 'Directory Synchronization Failure' will be generated.

10. Modify values as needed. Restart services after each modification.
     

Contact Support if assistance is required.