Fortiauthenticator shows tokens with pending status. Some users reports problem to use token and vpn

[jnascimento]

FortiAuthenticator is showing a lots of Fortitokens with pending status. Some users with tokens with this status are reporting problems to authenticate by VPN and some others users with tokens with this status are reporting that it is working well. The same actual today's configuration worked in the past and we don't have new configuration and with no changes in the IT infrastructure. See pictures bellow for a better analisys.

Does anyone here have any experience solving a similar problem?

[ozkanaltas]

Hello @jnascimento ,

In normal times pending status is shown by FortiAuthenticator when the user does not activate their token.  But you say, some user tokens show pending but they can connect to vpn with 2FA. It's an interesting point.

Are you sure, they connect with the 2FA code? Maybe in the radius rule you missed configuring force to 2FA. Because of that, they can connect without a 2FA code.

Can you check this status with your user? Which do you use a version of FortiAuthenticator?

https://community.fortinet.com/t5/FortiAuthenticator/Technical-Tip-How-to-resend-activation-codes-fo...

[jnascimento]

@ozkanaltas Thanks for your repply. Yes this is interesting point and I looks like a bug. I'm sure the users connect with the 2FA code, they cant connect without a 2FA code. Some users with tokens with pending status are reporting problems to authenticate by VPN but some others users with tokens with this status are reporting that it is working well. See pictures bellow for a better analisys.

[ndumaj]

Hello @jnascimento,

What is FAC firmware version?
Is this a new setup?
Did it work before, or you faced this issue after any upgrade?

BR

[fiesta]

Hey, is this solved? We happen to facing the same issue, the difference is, we unable to use it on SSL VPN, at 45% failed bounce back to beginning.

Login administrator to other fortinet device works fine with FAC token.

Notification of forticlient endpoint shows invalid username -7200 but we make sure there are no issue with configuration with by disabling the token on FAC.