FortiToken for FortiClient users CONCERN

[Moxeq]

Hello guys,

I don't know if that an expected behavior or a bug, or if it is configurable..

when the users connect via the FortiClient (we tried several versions) SSL VPN with a mobile token, they have two ways to do it:

1. inter the username and the password followed by the token directly after the password.

2. inter the username and the password hit connect, then the token display, after you enter it you can connect.

in the two ways you can connect successfully BUT, in the first method (which is wired I think in Fortinet product) the token on the FGT keeps in disable 2FA status on SSL VPN monitor, as it not applied to this user.

is that normal? or if there is a way to change it.

Thx

[AEK]

Definitely a bug. Nice catch!

[rbraha]

Hi @Moxeq ,

This is  used on FGT as a backward compatibility for other third party devices that cannot prompt for the field to prompt entering token. So in this case they can provide password+otp together in the password field.