Skip to main content
K
Kley2026
New Member
April 29, 2026
Question

FortiGate SSO Issue: Users Marked as “Orange” After Network Changes

  • April 29, 2026
  • 2 replies
  • 52 views

I am facing an issue where some users in the FortiGate firewall appear with an “orange” status instead of the normal connected (blue) state.

When this happens, the affected users experience restricted access, and some applications or websites are blocked.

Our environment is integrated with Active Directory (AD) using authentication (SSO). The issue seems to occur especially when users switch between different network connections, such as Wi-Fi, wired (LAN), or VPN. In these cases, the user’s IP address changes, and the FortiGate appears unable to properly recognize or maintain the authentication session.

We have already attempted the following troubleshooting steps:

  • Removed the user from the domain and rejoined
  • Reinstalled the FortiGate certificate

However, the issue persists.

Interestingly, when the user connects via a wired network, the status returns to normal (blue), and access is restored.

It appears that during network transitions, the user session becomes inconsistent, causing the FortiGate to mark the user as “orange” and apply restricted policies.

Has anyone experienced this issue before? What could be causing it, and what would be the best approach to resolve it?
 

 

    2 replies

    Markus_M
    Staff & Editor
    Markus_M
    Staff & Editor
    April 29, 2026

    The color is one thing, the case is probably another. The UPPER CASE users are FSSO users, while the lower case users are something else.

    Run on CLI a 
    diag firewall auth list
    which gives you the same list with more details, specifically which server added the user to that list. 
    For example in “config user fsso” you have an entry name, that will be listed as a “server” for the blue upper case users. The sysadminsg will be coming from a server likely listed under “config user ldap” or “config user radius”.

    AEK
    SuperUser
    AEK
    SuperUser
    April 29, 2026

    This is expected behavior when client uses both wired and wireless.

    There is some extra config to do on DNS and it should fix your issue.

    On the other hand you want more reliable result then you need SSO Mobility Agent as described on the tech tip.

     

    AEK
      Terms & ConditionsAccessibility statement