Skip to main content
ehamud
Staff
Staff
October 17, 2024

Technical Tip: Users cannot be authenticated with complex passwords with FortiAP 423E

  • October 17, 2024
  • 0 replies
  • 489 views
Description This article describes how to solve the authentication with wireless users using WPA3-Enterprise SSID after upgrading FortiGate to v7.2.8 onwards.
Scope FortiGate 7.2.8 onwards, FortiAP 423E v6.4-build0492.
Solution

SSID created with WPA-3 Enterprise can include a Group with internal users from FortiGate, these users are not able to be authenticated once a complex password is set for example q1Q!w2W@e3E#r4R$t5T%y6Y¨ or q1Q!w2W@e3E#r4R$t5T%y6Y.

 

When the user is tested directly from FortiGate the result is successful, but not under the SSID: 

 

The following command can test the internal user:

 

diagnose test authserver local
<group_name> <username> <password> [more_group_names]...

 

FortiGate # dia test authserver local VRD_WIFI_STAFF_ luiz.leme q1Q!w2W@e3E#r4R$t5T%y6Y

Token Code:******
authenticate user 'complexpassword' in group 'VRD_WIFI_STAFF_' succeeded

 

The result from the wireless device is that the device cannot join to the network and as a result the wireless user is not going to have IP, in this case is 0.0.0.0:

 

FortiGate # dia wireless-controller wlac -d sta online
vf=0 mpId=0 wtp=2 rId=1 wlan=wifi2 vlan_id=0 ip=0.0.0.0 ip6=:: mac=f8:e4:e3:d8:5e:af vci= host= wifiag user=complexpassword group=VRD_WIFI_STAFF_ signal=-43 noise=-95 idle=5 bw=0 use=3 chan=6 radio_type=11N security=wpa3_only_enterprise mpsk= encrypt=aes cp_authed=no l3r=1,0 G=0.0.0.0:0,0.0.0.0:0-0-0 -- 0.0.0.0:0 0,0 online=yes mimo=2

 

The technical explanation is that complex passwords are encoded on FortiGate 7.2.8 onwards with UTF-8, the special characters will be encoded as \702\650, and with English are encoded as \650, even though typing or copying and paste properly the password, the device cannot join to the Wireless SSID, it is because the encoded symbols are different and fail.

 

To fix this issue, upgrade the FortiGate to v7.4.5, and now the device can receive IP address:

 

FortiGate # dia wireless-controller wlac -d sta online

vf=0 mpId=0 wtp=2 rId=1 wlan=wifi2 vlan_id=0 ip=10.30.80.3 ip6=fe80::1896:362e:1fd7:e989 mac=f8:e4:e3:d8:5e:af vci= host=wifiag user=complexpassword group=VRD_WIFI_STAFF_ signal=-45 noise=-95 idle=1 bw=86 use=3 chan=6 radio_type=11N security=wpa3_only_enterprise mpsk= encrypt=aes cp_authed=no l3r=1,0 G=0.0.0.0:0,0.0.0.0:0-0-0 -- 0.0.0.0:0 0,0 online=yes mimo=2 ip6=*fe80::1896:362e:1fd7:e989,1,

    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!