Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
Bala2493
New Contributor

FortiNAC not able to use local user account database in local RADIUS mode

Hello,

 

I'm checking the possibility of local RADIUS using local user accounts(the ones created on FortiNAC) for authenticating user in Wireless 802.1x setup. As per my observation, it takes the LDAP user database by default.

 

Is there any configuration that needs to be done for this to work?

 

Thanks

5 REPLIES 5
Anthony_E
Community Manager
Community Manager

Hello Bala 2493,

 

Thank you for using the Community Forum.

I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.


Regards,

Anthony-Fortinet Community Team.
ebujedo
Staff
Staff

Hi Bala,

For local authentication in FortiNAC you should use an authentication policy using local configuration:
Policy & Objects>Authentication>>Configuration:
Select authentication method and in the dropdown menu select "local"
Create a policy using this configuration and make sure you host matches the User&Host profile for this policy.

 

If this helps to get it working as you need, thumbs up are welcome :)

 

Best regards.

 

Ezequiel.

Staff
Bala2493

Hi Ezequiel,

 

I'm aware of the Authentication policy and the same has been configured. But with regards to Wireless, how do we authenticate users using FortiNAC's local database instead of LDAP in Local RADIUS setup? Under the RADIUS service logs I see a RADIUS-Reject since it's referring to the LDAP instead of Local database.

 

As per my understanding, the policy engine is triggered only if a host record is created in FortiNAC but in my case the user doesn't even get connected to the SSID since the RADIUS authentication itself is failing with local credentials.

 

Regards,

-Bala

 

ebujedo
Staff
Staff

Hi Bala,

Have you tried to right-click on the SSID>SSID configuration> and selecting Radius mode as local ?

Which kind of controller are you trying to integrate, we have different deployment guides for different brands.

Reference Manuals:
https://docs.fortinet.com/product/fortinac/8.8
https://docs.fortinet.com/document/fortinac/8.8.0/wifi-802-1x-based-network-using-fortinac-local-rad...

 

Best regards.

 

Ezequiel.

Staff
Hawada1
Staff
Staff

Hi Bala,

Can you please configure the following:
1) Create a local user under User& Hosts >> User Accounts and assign it to a new Role (for example local-radius-role).


2) Create a new user group under System >> Groups example:
- Name: Local-User-GRP

- Member Type: User

- Selected Members: "radiususer"

3) Create a new User/Host Profiles (UHP) with the following:
-Who/What by Group: Local-User-GRP
-Who/What by Attribute: User[Role: local-radius-role]

4) Create a Network Access Policy and assign the UHP created to it.

 

*****
If a reply addresses your issue, please click on "Give Kudos"
*****

 

Best Regards,
Hawada1

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors