Explorer II

Question

Forticlient SSL VPN get connected without email token but no access to the network

Forum|Forum|1 year ago
October 10, 2024
9 replies
5093 views

Greetings,

I have a weird scenario using Forticlient connecting to SSLVPN. Our users connect to our Internal network using SSLVPN when they are working remotely. They are using Forticlient VPN with email token for enhanced authentication.

Lately, we encountered issue such that user were not prompted for email token and get direct access to the network but no access to any of the servers or internal network such as file share. We have 2 Active Directory servers and that the email token is set to point to AD1 while AD2 is our primary Active Directory. Both AD are replicated.

Has anybody encounter such issue before?

FortiClient

INT1

Explorer

Hello, if you haven't set in fortigate to ask for sign in on every next login i think it would save the credentials and allow them to connect without using their email and password

Chua_AugustineAuthor

Explorer II

Thanks for the reply, INT1. I would agree with you if I have not set to ask for sign in on every next login, the system will save the credentials and allow them to connect without any needs to enter login ID and password., but the thing is that they are prompted for credential. It is just after they complete entering the credential and hit the submit button, that it went direct without prompting for email token (which should not be the case). They should be prompted for email token, and only then allow the access. The workaround currently is to disconnect again and reconnect back, the second time reconnect, they will be prompted for email token. Hope this clarifies.

AEK

SuperUser

Hi Augustine

- Which FOS version?

- Which FortiClient version?

AEK

Chua_AugustineAuthor

Explorer II

We are running on 7.2.10 build1706(Mature) and for Forticlient 7.4.0.1658.

rbraha

Staff

Hi @Chua_Augustine

Make sure that you have enabled as Two-factor Authentication - Email Based two-factor authentication, also make sure that you don't have same local users in FGT ,because FGT first it will check his local database ,then will check LDAP or Radius server whichever replies first to his requests.

Some debug commands that you can run on FGT CLI:

diag debug application fnbamd -1

diag debug application sslvpn -1

diag debug enable

Chua_AugustineAuthor

Explorer II

Hi rbraha, Thanks for the suggestion. Email based two-factor authentication is enabled, and we are using LDAP to authenticate the users, and there is no local users in configured in FGT. Notice the token input field in the attached image. User will need to provide the email token before he can proceed to access the internal network. The token input field will not surface before the Username and Password get through successfully.

If the user input the token, s/he will be able to access the network. Problem arises when the first level of authentication went through without the prompt for token.

Chua_AugustineAuthor

Explorer II

Our setting indicates that we have the email authentication setup, username sensitivity is set to disabled, and using LDAP for authentication.

AEK

SuperUser

In addition to Braha's advice, in case you configured multiple authentication servers then follow the recommendation here:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-A-quick-guide-to-FortiGate-SSL-VPN-authentication/ta-p/202041

AEK

Chua_AugustineAuthor

Explorer II

Thank you, AEK. This is certainly a clear explaination regarding VPN authentication. However, I'm still uncertain if the FortiClient cache is also contributing to the issue.

Sign up

Login with SSO

Login to the community

Login with SSO