Identity based policies in MPLS environment

[tmoe]

I have 2 FG200B devices in HA running MR2 Patch6 firmware. I have an MPLS and network firewall from our ISP that connects our 10 plants across the US. Those plants each have a FortiWifi60B running MR2 Patch3 firmware. I have identity based policies in my corporate office with the FG200Bs and it works well. I tried to implement identity based policies at my plant locations to match corporate. It seems to work but sometimes users do not seem to get authenticated properly and therefore the policy fails and they have no internet access. The reason for this is so that from our FortiAnalyzer all users will be resolved back to a username for reporting instead of just their IP. My dns servers and login servers are in my corporate office so could there be some latency causing these issues? Anyone have any ideas for troubleshooting this one? Thank you in advance Tmoe

[laf]

Just check the SLA you ISP offers you; also use winmtr and see any network spike.

[ede_pfau]

You haven' t specified how users are authenticated - local, LDAP, RADIUS...? If you use local users this should work 100% of the time. With auth servers there is a timeout for responses which can be configured if too short.

[tmoe]

I am using FSAE for authentication.

[ede_pfau]

...running on a server that is -remote or -local? Think timeout.

[tmoe]

To our plants, it is remote. So I agree with the timeout issue. Where is that setting? CLI?

[ede_pfau]

Try this:

 gate # config system global 
 
 gate (global) # set remoteauthtimeout 
 <integer>    please input integer value (0-300)
 
 

It' s in seconds, 5 seconds is the default. Keep it as short as possible.

[tmoe]

I' ll take baby steps. I' ll try 10 seconds first and see if that resolves the issues. Thank you for your help!