Skip to main content
nmarche1
nmarche1
Explorer
May 10, 2023
Solved

MFA Timeout settings for third party authenticator

  • May 10, 2023
  • 3 replies
  • 5966 views

Hello everyone, 

We have started enrolling into PING ID authentication in my company and we are having trouble setting up the MFA wait time on the Fortigate VPN (The time it sits on 45%). 

Is there any way to set the time for third party authenticators on the fortigate CLI (or GUI but i was not able to find those settings anywhere on the GUI) or are those settings on the RADIUS side of the authentication. Currently i was able to somehow set the time from 5 to about 40 seconds even though every parameter i put into the CLI was 60+ seconds.

Thanks in advance for any help.

Best answer by aahmadzada

Maybe you have vdoms?

 

In that case yo should run these commands under a certain vdom.

 

Ahmad

3 replies

AEK
SuperUser
AEK
SuperUser
May 10, 2023

Hello

I think you are looking for this one:

config user radius
    edit radius1
        set timeout X  (default is 5)

Or:

config system global
    set remoteauthtimeout 5

 

AEK
nmarche1
nmarche1Author
Explorer
May 10, 2023

I have tried both of these, unfortunately they do not work.
No matter what value i put in the timeout time is at around 40 seconds but i do not have the 40 seconds in any parameter on my fortigate. 

 

aahmadzada
Staff
aahmadzada
Staff
May 10, 2023

Well, in such a case I would recommend running debugs on the FGT and pcap of the radius traffic just to see, if the Fortigate is the one, that is doing something wrong after 40 seconds.

Connect to Fortigate via putty(enabled session logging) and run these commands on
 
#diag deb reset
#diag debug console timestamp en
#diagnose debug application fnbamd -1
#diag debug enable

Parallelly run the Pcket capture between Fortigate and the Radius server via webgui
 
Now reproduce the issue.
Once reproduced, check the debug outputs to see, if the Fortigate is destroying the authentication session before the configured remoteauthtimeout value

Also, check the packet capture outputs, you might see something interesting as well.
 
Ahmad

nmarche1
nmarche1Author
Explorer
May 10, 2023

Maybe i am doing something wrong, 

I can get into my fortigate with SSH without problems but these commands are not working for me...

Anything i should enable for it to work?

 

AEK
SuperUser
AEK
SuperUser
May 15, 2023

Either you are on the wrong VDOM or you logged-in with a low privileged user.

Also make sure you configured the radius' timeout params via CLI in the right VDOM.

AEK
aahmadzada
Staff
aahmadzadaAnswer
Staff
May 15, 2023

Maybe you have vdoms?

 

In that case yo should run these commands under a certain vdom.

 

Ahmad

Terms & ConditionsAccessibility statement