How to fortigate admin-lockout-duration clear

[Jin-Gyu]

Hi

I have two questions.

1. Is there a way to set admin-lockout-duration to 100000 and let another administrator unlock it when the account is locked?

2. Is the criteria by which the account is locked not the account name but IP based?

Thank you

[esalija · Accepted solution]

Dear @Jin-Gyu ,

Setting admin-lockout-duration to 100000 and Unlocking by Another Administrator:

You can set the admin-lockout-duration to 100000 seconds using the CLI command:

config system global
set admin-lockout-duration 100000
end

However, unlocking a locked account by another administrator is not directly supported.

The lockout duration must pass, or the device must be rebooted to clear the lockout.

Criteria for Account Lockout:

The lockout is based on the account name, not the IP address.

Each administrator account has its own lockout settings, and the lockout is triggered by failed login attempts for that specific account.

https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/631730/setting-the-administr...

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/631730/setting-the-administrator-passwor...

Best regards,
Erlin

[Jin-Gyu]

Thank you for your answer!