| Description | This article describes the configuration to restrict the admin user to one active session at a time. |
| Scope | FortiGate. |
| Solution |
Log in to the device with the super-admin privilege admin account and go to settings.
To make the same changes to the configuration via CLI:
config system global
With this configuration, when an admin session is already established and active, the same admin account cannot be used to log in to FortiGate again.
For example, user 'admin' has logged into FortiGate GUI from 10.32.22.115, and the session is active.
FGT1_HO_TLP # get system admin status
Below are the messages FortiGate will show when the 'admin' tries to log in to FortiGate. In the GUI, the message is 'Authentication failure'.
In SSH, the message is 'Access denied'.
login as: admin
A log will be generated in FortiGate: 'Administrator admin login failed from https(x.x.x.x) because admin concurrent is disabled'.
date=2025-04-10 time=02:20:37 eventtime=1744276837186075837 tz="-0700" logid="0100032002" type="event" subtype="system" level="alert" vd="root" logdesc="Admin login failed" sn="0" user="admin" ui="ssh(172.26.153.52)" method="ssh" srcip=172.26.153.52 dstip=10.40.19.6 action="login" status="failed" reason="admin_concurrent_disabled" msg="Administrator admin login failed from ssh(172.26.153.52) because admin concurrent is disabled"
date=2025-04-10 time=01:56:46 eventtime=1744275407254713715 tz="-0700" logid="0100032002" type="event" subtype="system" level="alert" vd="root" logdesc="Admin login failed" sn="0" user="admin" ui="https(172.26.153.52)" method="https" srcip=172.26.153.52 dstip=10.40.19.6 action="login" status="failed" reason="admin_concurrent_disabled" msg="Administrator admin login failed from https(172.26.153.52) because admin concurrent is disabled"
Note: When an admin session is active through one protocol (such as SSH), no other admin sessions (like HTTPS) can be established until the current session ends. However, 'jsconsole' (GUI CLI Console) sessions, listed under 'exec disconnect-admin-session', are exempt from this restriction and do not count toward the one-session limit.
Related article: Technical Tip: Restricting multiple admin sessions from the same admin user |
