Wireless guest management is not working after version upgrade to 5.2.3

[technologist36]

Dear all,

Auto-generated guest users' usernames and passwords aren't working for guests. Configuration isn't changed after the upgrade. I have a user group of type "guest" was created and mapped to the auto-generated users. An address range object was created that defines the range of DHCP addresses of wireless clients. A policy rule was created by adding the user group and the address range as source and "all" destination toward the internet.

Now, a guest came in and tried to enter the auto-generated username and password in the authentication portal and portal keeps asking for credential.

Does this happen to anybody else?

Thanks

[Chris]

technologist36 wrote:

James, this has to do with authentication timeout. By default, it's 480 sec. As a security best practice, authentication timeout is necessary. Why is it a problem to you?

Thanks

Not a problem to me but for the users. They complain that they must need to login again.

It would be better if the login session would not be expire.

I have configured the login account with a lifetime for 8 hours.

So i think the timeout is not neccessary.

Can this be somewhere overridden?

[technologist36]

Unfortunately, you cannot disable auth timeout. However, you can configure the authentication type to be idle-timeout. I think your current timeout type is new-session.

set auth-timeout-type idle-timeout

http://docs-legacy.fortinet.com/fgt/handbook/cli_html/index.html#page/FortiOS%205.0%20CLI/config_use...

Thanks

[Chris]

I search around the knowledge base and found an interesting article.

http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD37221&sliceId=1...

I will give it a try.

Maybe also interesting for you. I let you know what was the result.

---snip---- The setting "set auth-timeout" controls authentication timeout for Firewall authentication users. By default this value is set to 5 minutes.     # config user setting     # set auth-timeout     <timeout_integer>    The auth-timeout range is 1 to 1440 minutes(24 hours).     # end The "auth-timeout type" setting controls how the authentication entry is removed.     # config user setting     # set auth-timeout-type ?     idle-timeout    Idle timeout.     hard-timeout    Hard timeout.     new-session     New session timeout.

[technologist36]

Yeah, I know this information already. I just posted the command to you. ;)

[Chris]

That was at the same time now. ;)

Yes the defaults are IDLE Timeout and 5minutes.

[Chris]

It works perfectly. Many thanks for the helpful hint. It is sufficient that "auth-timeout" is configured with 1440 minutes.

Because IDLE is the default value so it does not need to be configured additionally. For the period of 8 hours there is no renewed login. After 8 hours the account is disabled automatically.

[technologist36]

Glad to hear it worked for you. :)

Yes, you are right, the default is idle-timeout. Increasing the value will do. I thought you configured it in the past to another type other than idle-timeout.

Thanks

[technologist36]

Yeah, that's my motto too.