Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
PNCC-Jimmy
New Contributor II

SSL-VPN AzureAD MFA sign in timer

I have recently successfully set up our SSL-VPN with AzureAD SSO including MFA (conditional access)

 

Users are able to go through the process, sign in successfully and gain access, but there is a desire to extend the Azure MFA sign in window timeout process/prompts. By default, it appears there is a 30sec timer countdown set somewhere and it starts counting down in the sign-in window title bar as soon as the Azure window pops.

 

After doing some reading around these forums, on the FortiGate itself, i doubled the default timers for the 5 x "config sys global > set two-factor--xxxx" options but as expected, no change. I also up'ed the "config sys global > set remoteauthtimeout" to 10sec instead of the default 5.

*****
set remoteauthtimeout 10
set switch-controller enable
set timezone 71
set two-factor-email-expiry 120
set two-factor-fac-expiry 120
set two-factor-ftk-expiry 120
set two-factor-ftm-expiry 120
set two-factor-sms-expiry 120

*****

 

I have loosely looked through Azure and can't find much. We aren't using any on-prem or server NPS.

 

Where is this time being controlled from? Is there a way to extend this timer to more than 30sec? And if so, where/how?

 

Please let me know if there is a requirement for specific versions and or set up to provide a better picture of my scenario.

 

Thanks

1 Solution
Demir21
Staff
Staff

Hi, 

Please try to change the remoteauthtimeout under global settings to 60 seconds and check the behaviour.

View solution in original post

4 REPLIES 4
Demir21
Staff
Staff

Hi, 

Please try to change the remoteauthtimeout under global settings to 60 seconds and check the behaviour.

PNCC-Jimmy
New Contributor II

SSO countdown timer for AzureAD auth and MFA config is indeed controlled by the "remoteauthtimeout" setting in global settings. Thank you for the quick suggestion and quick fix

Debbie_FTNT
Staff
Staff

Hey PNCC-Jimmy,

 

to clarify the timing behavior:

- The main relevant timeout on FortiGate would be the remoteauthtimeout

-> that's how long the FortiGate will keep an SSLVPN authentication attempt active while waiting for a response from a remote server like SAML/LDAP/RADIUS

-> if this is too short, you would see issues with VPN not establishing after the SAML authentication - 'ERR_EMPTY_RESPONSE', or some HTTP errors, are quite common

-> increasing the remoteauthtimeout can help in those instances

 

If you have an issue with the MFA code/response not being accepted a certain time after you provide the user credentials, that's probably more on Azure side - Azure checks the credentials and MFA component, and would have related timers set somewhere (no idea where though), while FortiGate simply waits for the result of the authentication; FortiGate would not even be aware that there is an MFA component, as the entire authentication side is handled by Azure.

+++ Divide by Cucumber Error. Please Reinstall Universe and Reboot +++
jpsilva
New Contributor

Hi, In my case I follow the Fortinet documentation in this link: Fortinet documentation.
But, to change the time to login was necessary change this configuration: 

config system global

set remoteauthtimeout 60

end

 

With this configuration was possible gave 120 seconds to users to login. 

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors