Forticlient SSL VPN get connected without email token but no access to the network

[Chua_Augustine]

Greetings, 

I have a weird scenario using Forticlient connecting to SSLVPN. Our users connect to our Internal network using SSLVPN when they are working remotely. They are using Forticlient VPN with email token for enhanced authentication.

Lately, we encountered issue such that user were not prompted for email token and get direct access to the network but no access to any of the servers or internal network such as file share. We have 2 Active Directory servers and that the email token is set to point to AD1 while AD2 is our primary Active Directory. Both AD are replicated.

Has anybody encounter such issue before?

[INT1]

Hello, if you haven't set in fortigate  to ask for sign in on every next login i think it would save the credentials and allow them to connect without using their email and password

[Chua_Augustine]

Thanks for the reply, INT1. I would agree with you if I have not set to ask for sign in on every next login, the system will save the credentials and allow them to connect without any needs to enter login ID and password., but the thing is that they are prompted for credential. It is just after they complete entering the credential and hit the submit button, that it went direct without prompting for email token (which should not be the case).  They should be prompted for email token, and only then allow the access. The workaround currently is to disconnect again and reconnect back, the second time reconnect, they will be prompted for email token.  Hope this clarifies.

[AEK]

Hi Augustine

- Which FOS version?

- Which FortiClient version?

[Chua_Augustine]

We are running on 7.2.10 build1706(Mature) and for Forticlient 7.4.0.1658.

[rbraha]

Hi @Chua_Augustine 

Make sure that you have enabled as Two-factor Authentication - Email Based two-factor authentication, also make sure that you don't have  same local users in FGT ,because FGT first it will check his local database ,then will check LDAP or Radius server whichever replies first to his requests.

Some debug commands that you can run on FGT CLI:

diag debug application fnbamd -1

diag debug application sslvpn -1

diag debug enable

[Chua_Augustine]

Hi rbraha, Thanks for the suggestion. Email based two-factor authentication is enabled, and we are using LDAP to authenticate the users, and there is no local users in configured in FGT.  Notice the token input field in the attached image. User will need to provide the email token before he can proceed to access the internal network. The token input field will not surface before the Username and Password get through successfully.

If the user input the token, s/he will be able to access the network. Problem arises when the first level of authentication went through without the prompt for token.

[Chua_Augustine]

Our setting indicates that we have the email authentication setup, username sensitivity is set to disabled, and using LDAP for authentication.

[AEK]

In addition to Braha's advice, in case you configured multiple authentication servers then follow the recommendation here:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-A-quick-guide-to-FortiGate-SSL-VPN-authent...

[Chua_Augustine]

Thank you, AEK. This is certainly a clear explaination regarding VPN authentication. However, I'm still uncertain if the FortiClient cache is also contributing to the issue.