Skip to main content
abmas
abmas
New Member
August 9, 2016
Question

Some users randomly de-authenticated

  • August 9, 2016
  • 1 reply
  • 30913 views

Hi,

 

We're using Fortigate 300D (FortiOS 5.4) and have a AD FSSO Collector Agent (with WMI). Authentication is working fine except for few users. For those users for a reason I ignore, authentication is lost randomly, and then they lose their internet access. In that time they are not listed in the "Show all FSSO Logons". They are not listed in the "Show Logon Users" on the FSSO Server.

I know that they are autheticated on our Windows Domain.

 

To be authenticated they have to logoff and logon on their PC but after a random amount of time they get de-authenticaed.

 

Can anyone help, please ?

 

Best regards.

Abmas

 

1 reply

xsilver_FTNT
Staff
xsilver_FTNT
Staff
August 11, 2016

Hello Abmas, basically turn Collector log to debug level and some 50MB size and check what happened when such user looses his access and is gone from FSSO user list on Collector. 1. It might appear that WMI received logoff and so Collector removed user from list. 2. It might appear that user used 'Run as' and logged somewhere under different account, or some (possibly background) service has started on his workstation under different account. Such events usually create logon event on DC, with workstation's source IP. Causing the current user being overwritten in FSSO user list as workstation is believed to be owned/used by single user at a time.

 

Still no clue/resolved ? Then open a ticket on customer support postal (https://support.fortinet.com). Best regards, Tomas

dudarra
dudarra
New Member
September 8, 2016

try this...

 

 
The setting "set auth-timeout" controls authentication timeout for Firewall authentication users. By default this value is set to 5 minutes.
 
# config user setting
 # set auth-timeout
 <timeout_integer>    The auth-timeout range is 1 to 1440 minutes(24 hours).
 # end
 

 The "auth-timeout type" setting controls how the authentication entry is removed.
 
# config user setting
 # set auth-timeout-type ?
 idle-timeout    Idle timeout.
 hard-timeout    Hard timeout.
 new-session     New session timeout.
 

 By default, authentication timeout type is set to "idle-timeout".
 
 Idle timeout: User entry will be removed if there is no traffic received for configured idle time (5 minutes by default).
 
Example
 
 * User1 authenticated by identity based policy and granted to access resources.
 * Now the User1 idle timer can be triggered if there is no traffic received from the user, this can happen  in one of the following scenarios;
 
 - User locked the computer
 - User logged out of the computer.
 - User PC disconnected from network.
 - User PC shutdown or put to standby mode.
 
  * If there is no traffic received from the user IP address for the configured auth-timeout (5 minutes by default), user authentication entry will be removed.
 
 * If the user tries to access resources now, FortiGate will prompt the user to authenticate again.
 

 Hard timeout: User entry will be removed after the configured auth- timeout value
 
Example
 
 * User1 authenticated by identity based policy and granted to access resources.
 * FortiGate will forcefully remove the user authentication entry after configured auth-timeout setting (5 minutes by default). This is done irrespective of traffic received or not from the user.
 * Once the authentication entry is removed, user will be prompted to authenticate for further requests.
 

 New-session timeout: User will be prompted to authenticate for new sessions after the configured auth-timeout timer.
 
Example
  
 * User1 authenticated by identity based policy and generate a request to www.fortinet.com.
 * User will start a download from www.fortinet.com and does not generate further requests.
 * After 5 minutes (default auth-timeout), user tries to access www.google.com, now FortiGate will ask the user to authenticate again but the existing download to www.fortinet.com will not be terminated.
 

 Configuration CLI
 
config user setting
 set auth-timeout-type
 idle-timeout    Idle timeout.
 hard-timeout    Hard timeout.
 new-session     New session timeout.
 
xsilver_FTNT
Staff
xsilver_FTNT
Staff
September 14, 2016
@raffau .. it was said that those are FSSO users, so auth session might timeout and iprope record might get removed but if everything is OK in FSSO then user should persist in 'diag debug auth fsso list' -or- 'diag firewall auth list | grep -f fsso' till the user:
- log off the workstation
- fail in workstation check and timeout on dead entry interval
- another user log into the same workstation and so fsso record get overwritten
 
This might help you a bit ..
http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=fortigate-troubleshooting-40-mr3pdf
Page 185 - FSSO issues

        
                                                

        

    


            

                                        

            
                        

                                                                                                            
            






        

                    

    
    





    


                                        

                                                        

            
        
    






                                    
Terms & ConditionsAccessibility statement