Forticlient with Microsoft Authenticator

[PBANZ]

I tested the fullversion of forticlient connect before login with microsoft authenticator as the second factor auth.

I found the that in this scenario in all versions of client from 6.0.x up that the auth just times out. i had another rule that allowed the user with out 2fa and if i did a deny on the prompt it doesn't deny the user, the login times out and moves to the next rule. 

this is only with connect before login.

has anyone else encountered this, anyone found a way to solve it.

note: we are Not running EMS so can't log with TAC.

[isamt]

I have setup and tested using the nps-extension with the following documentation:

https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension-vpn#i...

Works fine for me

Not sure if you have setup in the same way.

[PBANZ]

yes setup the same, are you using a code number from the app or responding to the approve prompt. customer is using the approve/deny prompt in authenticator. the specific scenario  with connect before login and the authenticator prompt is failing. 

[isamt]

Yes, we are using the approve/deny prompt method.

If your Fortigate is not in the same site as the on-prem NPS server, then you will need to increase the default time-out for the RADIUS authentication.

On the Fortigate enter commands:

config user radius

edit "radius_server_name"

set timeout 30

default time-out is 5 secs. I found 30 worked for me.

latency between Fortigate and NPS server is 18ms

You can test the authentication directly from the Fortigate:

diagnose test authserver radius radius_server_name pap userid user_password

[Admin_FTNT]

From PBANZ:

Timers were adjusted, and auth works fine once a user is logged into the laptop. It only if they connect the vpn before they login that the issue occurs. Only discovered as there was a test rule after that allowed the user with out MFA and the user was in both security groups. They would deny the connection for testing and still be permitted.