Skip to main content
wcruvinel
Staff
wcruvinel
Staff
October 6, 2025

Troubleshooting Tip: Authentication loops occur in ZTNA connections requiring SAML authentication

  • October 6, 2025
  • 0 replies
  • 476 views
Description This article describes an issue where ZTNA connections using SAML authentication may experience authentication loops when FortiClient establishes multiple sessions with inconsistent cookies.
Scope

FortiGate v7.4.8, any FortiClient from v7.2.4 up to v7.4.3.
Solution

Symptoms:

  • ZTNA connection fails after SAML authentication on Windows and Mac endpoints.
  • Users experience repeated re-authentication every 3–15 minutes.
  • Pop-ups appear, and traffic flows break. 
  • Log entries show WAD rejecting FTNT-EP/AUTH with messages such as 'user cookie may be out of date. ignore it' and 'session cookie auth fail'.

 

Reproduction scenario:

  1. Generate a ZTNA connection request from a test endpoint.
  2. Complete SAML authentication successfully.
  3. After the ZTNA connection is established, execute the following command on the FortiGate acting as ZTNA Gateway:

 

diagnose wad user clear

 

  1. Generate communication from the endpoint to the ZTNA destination again.

     

  2. The ZTNA connection should re-establish, but it fails, and the endpoint remains unable to connect.

     

Solution:

FortiClient v7.4.4.
    Terms & ConditionsAccessibility statement