SSLVPN LDAP AD + MFA = NOT WORKING

victormeidy Lv1Posted May-14-2025 12:13

Last edited by victormeidy 2025-May-14 15:43.

Hi Team!

I need help with SSLVPN LDAP AD + MFA.
I tried using SSLVPN with Primary Auth to our AD LDAP and enable Dynamic Token Authentication as the Secondary Auth but it's not working. The login will prompt this error:
"Operation failed, probably because the server is busy. Please try again."

If I disable the Dynamic Token Authentication on Secondary Auth, I can login without any issue.

FYI, I'm using NGAF 8.047.

Anyone know the workaround?

Zonger has solved this question and earned 10 coins.

Posting a reply earns you 2 coins. An accepted reply earns you 20 coins and another 10 coins for replying within 10 minutes. (Expired) What is Coin?

Enter your mobile phone number and company name for better service. Go

The error indicates a misconfiguration or communication issue with the MFA token server. Check the following

Verify Token Binding:

Ensure the user's account in AD LDAP has the corresponding dynamic token assigned in the NGAF token management.

Go to System > User Management > Token Management and check if the token is correctly bound to the LDAP user.

Check User Source Settings:

Ensure the user source (LDAP) is selected in User > Authentication Policy > VPN Authentication and supports both LDAP and Dynamic Token.

Ensure Token Service is Active:

Confirm that the Dynamic Token Service is enabled under System > Security Settings > Dynamic Token.

Time Sync:

Check that the NGAF and the AD server have synchronized time as time differences can break token validation.

Log & Debug:

Enable debug logs for authentication in Log > System Logs > Debug to gather more precise error details.

Reproduce the error and check for token server timeout or token mismatch.
Is this answer helpful?
Ayra Posted May-14-2025 17:56
  
To troubleshoot your SSLVPN LDAP AD + MFA issue, let's break it down step by step:

Potential Causes
- *LDAP Server Configuration*: Ensure your LDAP server settings are correct, including server IP, port, and certificate.
- *MFA Configuration*: Verify your MFA settings, including FortiToken configuration and email settings for token delivery.
- *User Group Configuration*: Check that your user group includes the correct remote user and LDAP server.

Troubleshooting Steps
1. *Check LDAP Server Configuration*:
    - Go to User & Device > LDAP Servers and verify server settings.
    - Ensure the CA certificate is imported and selected.
2. *Verify MFA Configuration*:
    - Go to User & Device > User Definition and check FortiToken settings.
    - Ensure email address is correctly configured for token delivery.
3. *Test LDAP Authentication without MFA*:
    - Disable Dynamic Token Authentication and try logging in.
    - If successful, re-enable MFA and investigate token-related issues.
4. *Check FortiGate Configuration*:
    - Ensure FortiGate is configured to use the correct LDAP server and user group.
    - Verify SSL VPN settings, including authentication and portal mapping.

Additional Tips
- *Case Sensitivity*: Consider disabling username sensitivity in the CLI using `username-sensitivity disable`.
- *FortiGate Version*: Ensure you're running a compatible FortiGate version with your NGAF setup ¹.

Further Assistance
If these steps don't resolve the issue, provide more details about your setup, including FortiGate version and configuration, for more targeted assistance.
Exlegend Posted May-14-2025 19:27
  
Hi Dear,

Based on the query "SSLVPN LDAP AD + MFA = NOT WORKING," it seems like you are facing issues with Multi-Factor Authentication (MFA) not working when using LDAP and AD for SSL VPN authentication. Here is a detailed analysis and steps to troubleshoot the issue:

Check for the Latest Patch: According to the search results, you need to ensure that the latest patch is installed for the USG V600R007SPH010. This patch might contain fixes for MFA issues with SSL VPN connections. Ensure that your system is up to date.

Verify LDAP Configuration: The configuration of LDAP for SSL VPN needs to be correct. Refer to the document [3] for detailed steps on how to configure LDAP authentication for SSL VPN. Ensure that the configuration is done correctly and that the LDAP server is properly synchronized with the SSL VPN system.

Check Authentication Failures: The document [2] mentions common AD authentication failures and troubleshooting steps. Run the test-aaa command to test AD authentication and ensure that the LDAP over SSL scenario is correctly configured.

Review AD/LDAP Feature Requirements: The document [4] provides important details about AD/LDAP feature requirements. Ensure that the synchronization mode is correctly set and that there are no duplicate usernames causing issues. Also, check if the synchronization function is supported in your deployment scenario.

Check for MFA Compatibility: Ensure that the MFA solution you are using is compatible with the LDAP and AD setup. Some MFA solutions may require specific configurations or additional steps to work with LDAP and AD.

Review Logs and Error Messages: Check the logs and error messages for any specific issues or errors related to MFA, LDAP, or AD. This can provide more insight into what might be causing the problem.

Zonger Lv5Posted May-15-2025 05:47
  
The error indicates a misconfiguration or communication issue with the MFA token server. Check the following

Verify Token Binding:

Ensure the user's account in AD LDAP has the corresponding dynamic token assigned in the NGAF token management.

Go to System > User Management > Token Management and check if the token is correctly bound to the LDAP user.

Check User Source Settings:

Ensure the user source (LDAP) is selected in User > Authentication Policy > VPN Authentication and supports both LDAP and Dynamic Token.

Ensure Token Service is Active:

Confirm that the Dynamic Token Service is enabled under System > Security Settings > Dynamic Token.

Time Sync:

Check that the NGAF and the AD server have synchronized time as time differences can break token validation.

Log & Debug:

Enable debug logs for authentication in Log > System Logs > Debug to gather more precise error details.

Reproduce the error and check for token server timeout or token mismatch.

I Can Help:

Change

Moderator on This Board

1
148
3

Started Topics

Followers

Follow

917
183
94

Started Topics

Followers

Follow

Board Leaders