New Member

Question

Firewall authentication auth-timeout

Forum|Forum|1 year ago
December 10, 2024
2 replies
1218 views

I intend to configure FortiGate such that users are required to re-authenticate every 10 hours, regardless of whether user session are active or inactive. I have applied the following commands, but the session timer seems to refresh instead of decreasing. Could advise if this configuration is correct?

config user setting
set auth-cert "Fortinet_Factory"
set auth-timeout 600
set auth-timeout-type hard-timeout
end

Remark: i suspect it refreshing because of allow-idle

FortiGate

Staff

Hi @Ravin_ ,

Yes, it is correct.

Ravin_Author

New Member

Hi @dingjerry_FTNT , But when I run again the expire time get refreshs instead of decreasing, become 36000 again

Staff

Hi @Ravin_ ,

Weird. According to this KB:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-hard-timeout-for-authenticated-user/ta-p/189617

It should be working.

BTW, what is your FortiGate firmware version?

Staff

The change applies only to newly-created auth sessions.

Existing ones (created before the config change) will time out according to the rules as they were when the session was created.

Make sure you either test this on brand new logons, or simply wipe all pre-existing auth sessions to avoid confusion.