An administrator wants to configure timeouts for users. Regardless of the userג€™s behavior, the timer should start as soon as the user authenticates and expire after the configured value. Which timeout option should be configured on FortiGate?

FortiGate offers two main types of authentication timeouts. An idle-timeout resets whenever the user generates traffic, de-authenticating them only after a period of inactivity. A hard-timeout, however, sets an absolute session duration starting from the moment of authentication. It will de-authenticate the user when the timer expires, regardless of any ongoing activity. The scenario described requires the timer to expire after a configured value irrespective of the user's behavior, which is the exact function of a hard timeout.

A. auth-on-demand: This is a trigger for authentication within a firewall policy, not a type of timeout.
B. soft-timeout: This is not a valid timeout option in FortiOS.
C. idle-timeout: This timeout is based on user inactivity. The timer resets with traffic, which contradicts the requirement that the timeout is independent of user behavior.
D. new-session: This is a setting related to when authentication is required for new sessions, not a timeout mechanism.

FortiOS 7.0.0 CLI Reference, config user setting section, p. 2511: Defines auth-timeout-type with options idle-timeout and hard-timeout.

FortiOS 7.0.1 Firewall Handbook, "Firewall authentication" section, p. 101: Explains that a hard timeout "is an absolute timeout. The user is logged out when the timer expires, even if they are active."