SSL-VPN causing 100% CPU with NPS and Azure MFA Extension

[HubbaBubba]

Hi,

I have configured an existing SSL-VPN to use Radius. The Radius sends requests to a Microsoft NPS server with the Azure extension installed which will provide MFA requests.

All the config works great.

After several hours of running the server is maxing it's CPU at 100% on a COM surrogate process. Users get delays to the authentication request or none at all.

There is an event constantly logged that may be causing this issue:

Log Name: AuthZAdminCh Source: Microsoft-AzureMfa-AuthZ Date: 22/06/2020 09:46:16 Event ID: 3 Level: Critical User: NETWORK SERVICE Computer: Servername Description: NPS Extension for Azure MFA: CID: <> :Exception in Authentication Ext for User USername :: ErrorCode:: REQUEST_MISSING_CODE Msg:: Request is missing OTP Enter ERROR_CODE @ [link]https://go.microsoft.com/fwlink/?linkid=846827[/link] for detailed troubleshooting steps.

This request is coming from the FortiGate but does not relate to an active request for a user to log in, it appears to be an old request that does not timeout.

Can anyone point me to the settings that is causing these requests on the FortiGate?

[HubbaBubba]

After some testing and troubleshooting I cannot find a fix.

The current workaround is to restart the NPS server every 3 hours.

The full fix is to update the firmware on the firewall to Forti OS 6.0.9 or above which should happen in the next week on the managed firewall.

[Daas]

I am having the same issue.

Did the upgrade to 6.0.9 fix the problem permanent? 

[HubbaBubba]

Hi,

yes the upgrade fixed the problem permanently

Cheers

[MF_SRE]

I am having the very same issues  , but when I called fortinet they said that there is no such issue. I have the same setup except I am on 5.6.12 the highest my firewalls can go is 5.6.13, but in the changelog for 5.6.13 there is nothing on this NPS 100% cpu issue. 

[grenona]

Any one try this config to work

FortiClient VPN over NPS Server with Azure extention with key fob C200 Feitian.

How the token is return to the client ?