Technical Tip: Users cannot be authenticated with complex passwords with FortiAP 423E
| Description | This article describes how to solve the authentication with wireless users using WPA3-Enterprise SSID after upgrading FortiGate to v7.2.8 onwards. |
| Scope | FortiGate 7.2.8 onwards, FortiAP 423E v6.4-build0492. |
| Solution | SSID created with WPA-3 Enterprise can include a Group with internal users from FortiGate, these users are not able to be authenticated once a complex password is set for example q1Q!w2W@e3E#r4R$t5T%y6Y¨ or q1Q!w2W@e3E#r4R$t5T%y6Y.
When the user is tested directly from FortiGate the result is successful, but not under the SSID:
The following command can test the internal user:
diagnose test authserver local
FortiGate # dia test authserver local VRD_WIFI_STAFF_ luiz.leme q1Q!w2W@e3E#r4R$t5T%y6Y Token Code:******
The result from the wireless device is that the device cannot join to the network and as a result the wireless user is not going to have IP, in this case is 0.0.0.0:
FortiGate # dia wireless-controller wlac -d sta online
The technical explanation is that complex passwords are encoded on FortiGate 7.2.8 onwards with UTF-8, the special characters will be encoded as \702\650, and with English are encoded as \650, even though typing or copying and paste properly the password, the device cannot join to the Wireless SSID, it is because the encoded symbols are different and fail.
To fix this issue, upgrade the FortiGate to v7.4.5, and now the device can receive IP address:
FortiGate # dia wireless-controller wlac -d sta online vf=0 mpId=0 wtp=2 rId=1 wlan=wifi2 vlan_id=0 ip=10.30.80.3 ip6=fe80::1896:362e:1fd7:e989 mac=f8:e4:e3:d8:5e:af vci= host=wifiag user=complexpassword group=VRD_WIFI_STAFF_ signal=-45 noise=-95 idle=1 bw=86 use=3 chan=6 radio_type=11N security=wpa3_only_enterprise mpsk= encrypt=aes cp_authed=no l3r=1,0 G=0.0.0.0:0,0.0.0.0:0-0-0 -- 0.0.0.0:0 0,0 online=yes mimo=2 ip6=*fe80::1896:362e:1fd7:e989,1, |
