Skip to main content
JSNascimento
JSNascimento
New Member
February 10, 2025
Solved

Fortigate requiring token for internet access, even for users who should only use token with VPN.

  • February 10, 2025
  • 2 replies
  • 1659 views

This problem began after I upgraded Fortigate from 6.4.15 to 7.0.17 without any configuration changes. Before this, the issue was not observed. It's not a problem if it asks for a username and password; the issue is that it started asking for a token, which was initially required only for VPN users.

FortiGate is requiring a token for internet access, even for users who should only need a token only for VPN. The firewall integrates with MS AD with LDAP and FSSO.

VPN users authenticate with tokens via FortiAuthentication, also integrated with MS AD and LDAP. FortiGate requires a token for internet access only if users are in local, not when are in remote access.

All firewall rules for Internet access are configured to validate FSSO users, with LDAP validation as a fallback in the same rules. See the attached screenshot. 

i02.png

Best answer by AEK

Can you please run the following so I can understand more?

 

Start auth debug:

diagnose debug application fnbamd 255
diagnose debug enable

 

Run ldap auth test with the affected user:

diag test authserver ldap <AD_LDAP> <user> <password>

 

Run ldap auth test with the affected user:

diag test authserver radius <RADIUS_SERVER> <method> <user> <password>

 

Then generate the required traffic to trigger the firewall policy.

And share all the above output, each separately.

2 replies

AEK
SuperUser
AEK
SuperUser
February 10, 2025

If you are using FSSO in firewall rules then it should not require token because it is passive authentication.

AEK
    JSNascimento
    JSNascimentoAuthor
    New Member
    February 11, 2025

    Thanks for reply. You are right, but let me explain better. All firewall rules for Internet access are configured to validate FSSO users, with LDAP validation as a fallback in the same rules. See the attached screenshot.

    Please feel free for comment, you're welcome.

    AEK
    SuperUser
    AEKAnswer
    SuperUser
    February 12, 2025

    Can you please run the following so I can understand more?

     

    Start auth debug:

    diagnose debug application fnbamd 255
    diagnose debug enable

     

    Run ldap auth test with the affected user:

    diag test authserver ldap <AD_LDAP> <user> <password>

     

    Run ldap auth test with the affected user:

    diag test authserver radius <RADIUS_SERVER> <method> <user> <password>

     

    Then generate the required traffic to trigger the firewall policy.

    And share all the above output, each separately.

    AEK
    Terms & ConditionsAccessibility statement