Description
This article describes how to increase email Token expiry time via CLI. In some cases due to email delays, users cannot log-in due to Token code expiry.
Scope
FortiGate.
Solution
Use the following command:
config system global
set two-factor-email-expiry 300
set remoteauthtimeout 300
end
It explains that 'two-factor-email-expiry' defines how long the 2FA code (email-based token) remains valid, in seconds, and 'remoteauthtimeout'defines how long FortiGate waits for the remote authentication server (RADIUS/LDAP/SAML/etc.) to respond before timing out.
'remoteauthtimeout' does not control 2FA code validity directly but affects the overall login process.
'remoteauthtimeout' command will override the two-factor-email-expiry, so increase both timers. The mentioned value is in seconds.
This timer is not correctly applied in some of the latest versions (v7.2.10+, v7.4.5+, v7.6.1+) when using IPsec (IKEv2) Remote Access VPN. This is a known issue, tracked under bug 1087651, which will be fixed in v7.6.3 and v7.4.8 (until now).
If upgrading to v7.6.3 and v7.4.8 does not resolve the issue, use IKEv1 as a workaround.
