Troubleshooting Tip: Authentication Fails with '40105 Bad Request Timestamp' error with Cisco Duo

Symptoms.

• Authentication requests fail with the following error:

"failed (Invalid Authentication: {"code": 40105, "message": "Bad request timestamp", "stat": "FAIL"}Invalid Authentication: {"code": 40105, "message": "Bad request timestamp", "stat": "FAIL"}Invalid Authentication: {"code": 40105, "message": "Bad request timestamp", "stat": "FAIL"})"

• Leap status shows 'Not synchronized'.
• NTP sources are unreachable:

Reach = 0
LastRx = 0
Last sample = 0

The issue occurs when the Collector system time is not synchronized due to a failure in communicating with configured NTP servers. This leads to a timestamp mismatch, causing Cisco Duo authentication requests to be rejected.

Troubleshooting steps:

1. Modify the chrony.conf:

sudo vi /etc/chrony.conf

2. Add a reachable NTP server. Example:

time.google.com iburst

3. Restart the Chrony service:

sudo systemctl restart chronyd.service

4. Verify service status:

systemctl status chronyd.service

5. Confirm synchronization:

chronyc sources -v
chronyc tracking

Ensuring proper NTP synchronization on the FortiSIEM Collector should resolve timestamp-related authentication failures with Cisco Duo.