Fortinet Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
chethan
New Contributor III

FortiAuthenticator: FortiToken 2FA fails (sometimes)

Hi Everyone,

 

We have created and are using SSL-VPN on FortiGate with 2FA configured on FortiAuthenticator for remote employees for almost a year now.

 

The users are Remote LDAP users and FortiToken is configured on FortiAuthenticator.

 

Recently we started noticing that, when the VPN users when they login through FortiClient, the authentication fails.

 

The logs on FortiAuthenticator shows this: "Remote LDAP user authentication(mschap) with FortiToken failed: remote server supports pap only"

 

And, this issue is not permanent. The same user when he/she tries to login with token after few minutes the authentication succeeds without any problem.

 

How do we fix this issue? As the users need to wait a long time before they login again.

 

Thank you

Chethan
NSE 4
3 REPLIES 3
Debbie_FTNT
Staff
Staff

Hey Chethan,

if you have the FortiGate authenticate to FortiAuthenticator via RADIUS, and RADIUS checks the credentials against LDAP, the FortiGate-FortiAuthenticator connection must use either PAP, or MSCHAPv2 if FortiAuthenticator is joined to the domain and Windows AD Authentication is toggled on.

By default, FortiGate will try CHAP, MSCHAPv2, then PAP, when authenticating against RADIUS. Try setting PAP in FortiGate:

Debbie_FTNT_0-1641812724969.png

That should at least fix the errors related to 'remote server supports pap only'.

If 2FA only fails on occasion, you could also be looking at a timeout issue on FortiGate. If the issue persists, perhaps increasing the "remoteauthtimeout" value will help:
#config global
#config system global

#set remoteauthtimeout 60  <-- in seconds; this is how long FortiGate will wait for authentication to complete before declaring a timeout

#end

+++ Divide by Cucumber Error. Please Reinstall Universe and Reboot +++
chethan
New Contributor III

Thank you.

 

I had set it to PAP on FortiGate, and did the mentioned things above. But was still receiving that error.

 

We reset the AD admin password and re-synced it. 

It is stable for a month now.

 

 

Chethan
NSE 4
Debbie_FTNT

Hey Chethan,

good to hear :)

+++ Divide by Cucumber Error. Please Reinstall Universe and Reboot +++