FortiToken clock drift detected -> problems when trying to sign in

[dahin]

Hello dear community!

A colleague is currently experiencing problems with his mobile phone VPN token. When he tries to sign in using the code provided by the forti app, the first login attempt almost always fails. On the second attempt the website says "Fortitoken clock drift detected (code: 506108). Please input the next code and continue.". Then, on the next try, an error pops up (455 access denied) and two to four tries later it finally works.

How can this asynchronity of clocks (which seems to be the problem) be changed?

Best regards,

Daniel

[dred_FTNT]

Hi Daniel, Can you have your colleague confirm that the mobile device clock is accurate - set to network time and the correct time zone.  If the device clock is indeed set correctly, please let us know if this is the iOS or Android version of the FortiToken Mobile app. Thanks, David

[dahin]

Hey David,

he opens an hotspot with his android phone and then tries to log in with his iOS phone (both clocks are almost in sync -> 1-2 seconds apart). On the first log in attempt he almost always gets the 455 error. The other error (clock drift) is only displayed when using the guest WLAN in our company (not using the hotspot). For OS versions, I will have to contact him again.

Thanks for your help,

Daniel

Edit: iOS version is 8.2 and Forti-App version is 3.0.4.0067

Edit 2: Now the forti app on the mobile phone (iOS 8.2) doesnt display a valid access code (https://forum.fortinet.com/tm.aspx?tree=true&m=130979&mpage=1)

[dahin]

Bump

[dred_FTNT]

Hi Daniel,

The issue with the wrong OTP being displayed in some cases on FTM iOS version has been identified and fixed.  The new version (3.05) is being uploaded to the Apple app store and should be available in the next week or so. Workaround is to always quit the app when done with it.  

I could not reproduce the the issue with the 455 (access denied) using my Android as a hotspot and iPhone running client, but it would appear to be something on the Fortigate side since the credentials are being received by the FortiGate.

thanks,

David

[anthony_christensen]

To correct the drift issue you can run the following command "exec fortitoken sync" if your not familiar with this command running "exec foritoken sync ?" should lead you in the right direction. 

Thanks,