FortiGate FGT200F-HA2 VPN DUO 2FA access denied issues

[julianhaines]

In the past week I have been having issues with VPN users getting access denied when trying to connect to the VPN via FortiClient, if they try enough times it will finally connect.

the DUO Authentication Proxy is locally running on Windows 2016 and is the latest version I have white-listed the DUO URL, bypassed in the certificate inspection, and allowed in the local Firewall.

In the logs on the DUO Proxy, I am getting the error below I have raised this with DUO support and they say it looks like a FortiGate issue, I have checked the logs on the FortiGate and can't see anything getting blocked so not sure what it can be.

Has anyone seen this before?

2024-07-30T08:34:12.461578+0100 [duoauthproxy.lib.log#critical] Duo auth call failed
Traceback (most recent call last):
File "twisted\internet\defer.pyc", line 1075, in _runCallbacks

File "twisted\internet\defer.pyc", line 1946, in _gotResultInlineCallbacks

File "twisted\internet\defer.pyc", line 1996, in _inlineCallbacks

File "twisted\python\failure.pyc", line 519, in throwExceptionIntoGenerator

--- <exception caught here> ---
File "duoauthproxy\lib\radius\duo_server.pyc", line 222, in duo_auth_only

File "twisted\internet\defer.pyc", line 1996, in _inlineCallbacks

File "twisted\python\failure.pyc", line 519, in throwExceptionIntoGenerator

File "duoauthproxy\lib\duo_api\auth_client.pyc", line 136, in auth

File "twisted\internet\defer.pyc", line 1996, in _inlineCallbacks

File "twisted\python\failure.pyc", line 519, in throwExceptionIntoGenerator

File "duoauthproxy\lib\duo_api\base_client.pyc", line 138, in call

File "twisted\internet\defer.pyc", line 1075, in _runCallbacks

File "duoauthproxy\lib\duo_api\auth_client.pyc", line 65, in err_func

duoauthproxy.lib.duo_api.duo_api_errors.DuoAPIFailClosedError: API Request Failed: ConnectionLost('Connection lost')

[KumarV]

Hello,

As mentioned by you that it connects after few tries, then you can try to increase the remote authentication timer on Fortigate configuration.

config system global

set remoteauthtimeout 300

end

I would suggested you to change it to max for now just for testing and see if that works.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Explaining-global-set-remoteauthtimeout-us...