Technical Tip: Customizing SSL VPN Authentication Timeout per User

[raksshaya]

Description	This article explains how to override the global SSL VPN authentication timeout in FortiGate by configuring custom authentication timeouts for individual local users.
Scope	FortiGate.
Solution	By default, when a user connects to SSL VPN, the global authentication timeout defined in the SSL VPN settings is applied to the session. Authentication timeout can be customized per user, the following configuration demonstrates how to assign different authentication timeouts to specific users, for example: User A: 5 minutes. User B: 1 hour. All other users:  Use the default authtimeout value in SSL VPN settings. Default Behavior. By default, local users are configured with an authtimeout value of 0, which means the global SSL VPN authentication timeout applies: config user local   edit "Test"    set authtimeout 0   next end Note: For a local user, the authtimeout value is an integer from <0> to <1440>(24 hours). Custom Authentication Timeout per User. To set custom authentication timeouts for specific users, configure as follows: config user local   edit "UserA"    set authtimeout 5           <----- 5 minutes.   next end config user local   edit "UserB"    set authtimeout 60         <----- 60 minutes (1 hour).   next end Note: The auth-timeout setting cannot be applied to user groups. It is supported only at the global SSL VPN level or per individual local user. Users with authtimeout set to 0 will inherit the global timeout value. For more information, refer this KB article: Technical Tip: 'auth-timeout' setting for SSL-VPN  Global SSL VPN Authentication Timeout. The global timeout value is set under the SSL VPN settings: config vpn ssl settings    set auth-timeout 28800 (8 hours) end To apply a uniform timeout for all SSL VPN users, modify this setting accordingly. For a detailed explanation of SSL VPN session timers, refer to this KB article: Technical Tip: SSL VPN timers explanation and SSL VPN Login Attempt Limit (aka 'Lockout')   To view the SSL VPN users connected, go to Dashboard -> SSL-VPN Monitor: Related article: Technical Tip: 'auth-timeout' setting for SSL-VPN