An administrator wants to configure timeouts for users. Regardless of the userג€™s behavior, the timer should start as soon as the user authenticates…

FortiGate offers two main types of authentication timeouts. An idle-timeout resets whenever the user generates traffic, de-authenticating them only after a period of inactivity. A hard-timeout, however, sets an absolute session duration starting from the moment of authentication. It will de-authenticate the user when the timer expires, regardless of any ongoing activity. The scenario described requires the timer to expire after a configured value irrespective of the user's behavior, which is the exact function of a hard timeout.

A. auth-on-demand: This is a trigger for authentication within a firewall policy, not a type of timeout.

B. soft-timeout: This is not a valid timeout option in FortiOS.

C. idle-timeout: This timeout is based on user inactivity. The timer resets with traffic, which contradicts the requirement that the timeout is independent of user behavior.

D. new-session: This is a setting related to when authentication is required for new sessions, not a timeout mechanism.

FortiOS 7.0.0 CLI Reference, config user setting section, p. 2511: Defines auth-timeout-type with options idle-timeout and hard-timeout.

FortiOS 7.0.1 Firewall Handbook, "Firewall authentication" section, p. 101: Explains that a hard timeout "is an absolute timeout. The user is logged out when the timer expires, even if they are active."