“Authentication failed, bad token code” without prompting for token

Fortiauthenticator configured with RADIUS client (fortigate) to accept MSCHAPv2, and synced with AD. (Users are imported and have tokens assigned). When using "Test User Credentials" functionality in FGT using AD creds it prompts for 2fa as it should. 

However when trying to connect via FortiClient using IPSec remote access tunnel with AD credentials, it doesn't prompt for 2fa and instead gives 'Wrong Credentials EAP' error, and FAC logs show the following error: “Windows AD user authentication from x.x.x.x (mschap) with FortiToken failed: invalid token".

Additional information: I was testing password renewal functionality in FAC (from this guide: https://community.fortinet.com/fortigate-3/technical-tip-radius-user-password-renewal-using-dial-up-ipsec-tunnel-203013), as well as assigning a token to a new account, however problem described affects every user. Reverting configs in FGT and resetting/syncing/verifying token validity (it returns correct 2fa codes) doesn't solve the problem. Unsure how to troubleshoot this, can post detailed logs from FAC if needed.