Prevent students from using both computer, phone and tablet at the same time

Hi,

auth-concurrent should work. Make sure you haven't overridden those via auth-concurrent on per user or per group level with unlimited setting. Or on the other hand try to override global setting on per user level basis, as per user setting does have precedence over global setting (as it is more specific).

If you want to let them login from authorized devices only, then, besides of implementation of some serious NAC (Network Access Controller), you can also ...

1.

control access on IP level. Only specific IPs from workstations allowed. IPs set statically, no automatic IP assignment to new devices. Weak as one can set his own static IP.

2.

MAC based .. IPs assigned semi-statically by DHCP which will assign IP just to reserved MAC addresses.

Need to enroll MAC addresses to DHCP reservation. Small list can be maintained even by FortiGate. Bigger deployments should use separate DHCP server. IP per MAC assignment is old but still good trick.

Stronger as it's harder to get your MAC enrolled in, weak against misuse and setting IP from expected pool statically.

3.

802.1x port based authentication. Could be for example even EAP-TLS for wired or wifi. Certs and PKI involved and so cert enrollment for users/computers needed. For example FortiAuthenticator, if in place, can let users self-enroll their own device certificates but for set amount of devices, like 1 device only, to limit and have some control over BYOD scenario.

Enrollment can be controlled or even mandate admin approval.

That's more complex scenario and more secure from my point of view.

It looks like you're on the right track, but the issue might be a bit more nuanced. The policy-auth-concurrent setting is indeed designed to limit the number of concurrent user sessions, but since you're using WPA2 Enterprise with local FortiGate authentication, there could be other factors at play. FortiGate's session limits typically apply to web authentication rather than WPA2 Enterprise, which might explain why you're still able to log in from multiple devices simultaneously.

To achieve what you're looking for—restricting users to one device at a time—you may need to explore more advanced features like per-user session limits under user group policies or consider using MAC filtering. Alternatively, leveraging FortiGate's captive portal and enabling device identity-based access control could provide more granular control over how many devices can connect per user.

If these options don’t work, you might want to check the FortiGate documentation or reach out to Fortinet support for more tailored guidance.

Managing device concurrency for students on school WiFi can definitely be tricky, especially when moving from something simpler like Untangle to FortiGate’s more enterprise-level setup. From my experience, policy-auth-concurrent should ideally limit the number of concurrent authenticated sessions per user. However, it's important to ensure that all devices are indeed authenticating separately (not sharing sessions) and that your FortiGate policy is properly enforcing per-user authentication, not just per device MAC address or IP.

Sometimes, an extra RADIUS attribute enforcement or more strict user identity-based policies help in such cases. Also, session TTL settings can impact how quickly sessions are cleared when switching devices. Might be worth checking if enabling per-user identification or using FortiNAC for deeper device control is an option!

If you're looking for easy ways to plan your projects or calculate profitability, feel free to explore my free online calculator tools

calculatrice m2 । calcule en m2 । calculer le m2 । calcul au m2 । calculatrice । calculer m2