Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor

Token field does not displays from the forticlient VPN

In my understanding and the most of cases,

when logging in with Forticlent VPN(to connect to the in-house server), should enter username and password. then Token field has to be displays, user has to type in the Token in displayed token field.

However, some of our members possible to connect to the in-house server without type in to token field. (Token Field does not even displays).
*Token is already given to the member in Fortigate


How can I make client to displays the Token Field?

-forticlient token field issue.pngFortiClient VPN



This is only a guess, but a common case for two-factor authentication not triggering is case-sensitivity.


As an example:

- you have an LDAP server (ldap1)

- you have a user on FortiGate (user1) with a token

-> the user1 is of type ldap:
config user local
edit user1

set type ldap

set ldap-server ldap1

set token FTKxxxxxxxxxxxxxx



The FortiGate is case sensitive by default.

This means:

- if the user logs in with 'user1', this matches the local user entry, and token will be required

- if the user logs in with 'User1' or 'uSer1' or similar, then this will NOT match the local entry, and (depending on SSLVPN, group and policy configuration) go straight to LDAP instead

-> as LDAP is NOT case-sensitive, the user will be authenticated (without the token prompt)


Essentially: If the user does not match the local entry on FortiGate, two-factor authentication will not be triggered, so no token field appears.


You can refer to these KBs for a more detailed dive into the mechanism:

+++ Divide by Cucumber Error. Please Reinstall Universe and Reboot +++

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Top Kudoed Authors