Different icons for FortiGate SSL VPN users, what does it mean?

[Riggie]

Hello,

We offer a SSL VPN for our clients. They all connect the same way through the FortiClient application and use two-factor authentication (FortiToken). Some users do have a different icon when using the account dashboard. Is there documentation available what these icons mean?

As you can see in the image above one user has a blue-ish icon. It's in the same group and has about the same usage and connection time as user #3. We're running firmware 7.2.x.

[Anthony_E]

Hello Riggie,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Riggie]

Thanks @Anthony_E,

I tried using Google to find an answer but couldn't find answer yet. Hopefully you're able to find something!

[Riggie]

@Anthony_EDid you manage to find something?

[ebilcari]

you can check the users via CLI using this command:

#diag firewall auth list

It looks like it have to do with the authentication source:

Icon -> Local user.
Blue icon -> Remote user, LDAP or Radius.

There is also this explanation but it's more for local LAN devices: https://community.fortinet.com/t5/Support-Forum/Color-of-Human-Shape-Icon-Meaning/m-p/28105/highligh...

[Riggie]

Hello @ebilcari,

Thanks for your reply. The weird thing is that we only have LDAP users and that only some (a real small percentage) get the blue icon.

[Riggie]

Hello @ebilcari @Anthony_E 

I've used the command you've shared in your post, and I see one difference if a user has another icon: the inactivity flag.

Is it possible that the icon changes if a users activity changes to 'idle'?

Is there a known list of icons for future reference?

[ebilcari]

Thanks for sharing your findings [idled: 1 -> blue]. I couldn't find a documentation that includes all the icons and their meanings.

[Anthony_E]

Hello,

I m sorry I m still on it! I will push today and I come back to you before tomorrow!

Regards,

[funkylicious]

Hmm, if I recall correctly when I saw something like this was because some users were created locally, some where from AD/LDAP .