how to limit concurrent login

Those situation you' ve mentioned rely on external authentication mechanisms, non-native firewall feature. If you define PPTP users locally to FortiGate, it' s not possible control simultaneous login as ukwizard pointed out. If you can rely on external auth like radius and that radius implementation support " simultaneous-use" (not many can do that) you could give it a shot.

Testing with freeRadius and NTTack shows that fortigate can' t do this. i hope Fortinet add this feature very soon.

It' s not a fortigate task to do; all the double-auth check is done in radius server, so it' s a topic to solve from radius server side; i.e. Radiator server, from australian company Open, is a non-free radius server that can check multiple logins within RADIUS active users (non FGT) and block concurrent logins. It' s the radius server that deny the auth is the user is already in its table; there' s no ' disconnect' features (so you cannot disconnect an user issuing commands from radius server) and those things, because the FTG it' s not a network access server (nas) talking with radius server. Check within Fortinet docs for radius dictionary attributes available. There' re new ones with each firmware version. regards

I doubt that v4 will have any pptp changes.

agree; pptp is going to deprecated state with time (not only under FTG)

The way i see it is, the auth server is only contacted to authenticate the server. When they user logs off i do not think there is any mechanism for the fortinet to tell the auth server they have. hence it cannot track them. Thats how i see it, is that what you are saying abelio?

Almost. Radius maintain its own table of authenticated users; there' s no a mechanism that allow radius to receive a notification from FTG when user disconnects. Radius server could detect detect a new access from that user and deny it if that user lives within authenticated usertable. So, under such limited scenario, is useless. However, another radius settings or conditions could you enable cleaning authenticated users from the table and make the scenari more usable.

.i hope Fortinet add this attribute to its nas box very soon.

agree with ukwizard, i really doubt it unless you have success in convince them to move up that request within " features_stack pile" . If that feature is critical to your business, ask your reseller/partner for the way to put a request to Fortinet.