Troubleshooting Tip: How to debug RADIUS protocol on the FortiAP CLI

Description

This article describes how to debug the RADIUS protocol on the FortiAP CLI.

Scope

FortiAP when managed by FortiEdge Cloud service or deployed with local standalone and local authentication.

Solution

When FortiAPs are deployed on the FortiEdge Cloud service or deployed on a FortiGate wireless controller with survivability, there is no information available to display by using traditional debug commands for authentication daemons. This is because those processes are running locally on the FortiAP instead of the FortiGate, and there is no debugging interface available on FortiEdge Cloud services for network administrators.

To bypass this limitation, configure 'RADIUS Authentication by AP' on FortiEdge Cloud services to instruct the service to run the authentication process directly on the FortiAP. This provides the advantage that if FortiEdge Services are not reachable for any reason, FortiAP devices can still contact the RADIUS server directly. The same result can be achieved for remotely deployed FortiAPs if 'local authentication' and 'local stand-alone' options are selected for a bridge VAP to overcome a wireless controller disconnection.

A VAP deployed on a FortiAP with those features enabled is displayed as follows:

vcfg
-------------------------------VAP Configuration    3----------------------------
Radio Id  2 WLAN Id  0 Test ADMIN_UP(INTF_UP) init_done
0.0.0.0/0.0.0.0 unknown (-1)
           vlanid=0, intf=wlan20,
vap=0xd837862, bssid=38:c0:ea:24:0e:80
           11ax
high-efficiency=enabled target-wake-time=enabled
          bss-color-partial=enabled
           mesh backhaul=disabled
           local_auth=enabled
standalone=enabled nat_mode=disabled
           bandsteering=disabled
           local_bridging=enabled
split_tunnel=disabled layer3_roaming=disabled…
 
           Rad   Acct ID:              
               Server: 192.0.2.10:1812 
               Acct Svr:              
               RADIUS CoA: disabled
               Acct-all-servers: disabled
               RADIUS Protocol: UDP

With a VAP on ADMIN_UP(INTF_UP) init_done status, it is possible to use app debug to display RADIUS messages in real-time using the FortiAP CLI command cw_debug app and turn on debug on level 255 for the following daemons.

cw_debug app all
wifi             debug level is 255 (0xff)
hostapd          debug level is 255 (0xff)
radius-das       debug level is 255 (0xff)

Wi-Fi connection, hostapd, and RADIUS messages from the STAs connected to this FortiAP will now be observable on the FortiAP CLI.

99232.241 vap<2-0>  entering
state RUN
45002.241 ba:b8:59:5a:af:fb <eh> IEEE 802.1X (EAPOL 41B) <==
ba:b8:59:5a:af:fb rId 2 wId 0 38:c0:ea:24:0e:80
IEEE 802.1X: 41 bytes from ba:b8:59:5a:af:fb (encrypted=-1)
   IEEE 802.1X: version=1 type=0
length=37
45002.242 ba:b8:59:5a:af:fb <eh>     recv IEEE 802.1X ver=1 type=0 (EAP_PACKET)
data len=37 
EAP: code=2 (response) identifier=218 length=37
99232.242 vap<2-0>  STA
ba:b8:59:5a:af:fb IEEE 802.1X: received EAP packet (code=2 id=218 len=37) from
STA: EAP Response-unknown (25)
99232.242 vap<2-0>  entering
state IDLE
IEEE 802.1X: ba:b8:59:5a:af:fb BE_AUTH entering state RESPONSE
EAP: EAP entering state RECEIVED2
EAP: parseEapResp: rxResp=1 rxInitiate=0 respId=218 respMethod=25
respVendor=0 respVendorMethod=0
EAP: EAP entering state AAA_REQUEST
EAP: EAP entering state AAA_IDLE
Encapsulating EAP message into a RADIUS packet
Copied RADIUS State Attribute
99232.244 vap<2-0> Sending RADIUS message
         to authentication server
192.0.2.10 by sock 11
RADIUS message: code=1 (Access-Request) identifier=228 length=332
   Attribute 80
(Message-Authenticator) length=18
      Value:
0cbebd6b6067a76cb35f8edc44c10200
   Attribute 1 (User-Name)
length=8
      Value: 'adolfo'
   Attribute 4 (NAS-IP-Address)
length=6
      Value: 192.0.2.101
   Attribute 32 (NAS-Identifier)
length=7
      Value: 'vap20'
   Attribute 30
(Called-Station-Id) length=28
      Value: '38-C0-EA-24-0E-68:Test'
   Attribute 61 (NAS-Port-Type) length=6
      Value: 19
   Attribute 6 (Service-Type)
length=6
      Value: 2
   Attribute 5 (NAS-Port) length=6
      Value: 4
   Attribute 26 (Vendor-Specific)
length=16
      Value:
00003044070a5465636f6e657374
   Attribute 26 (Vendor-Specific)
length=22
      Value:
0000304408104650323333472d6f666963696e61
   Attribute 31
(Calling-Station-Id) length=19
      Value: 'BA-B8-59-5A-AF-FB'
   Attribute 77 (Connect-Info)
length=33
      Value: 'CONNECT
23/5Mbps(Tx/Rx) invalid'
   Attribute 44 (Acct-Session-Id)
length=18
      Value: '6A54DA3500000047'
   Attribute 50
(Acct-Multi-Session-Id) length=18
      Value: 'A2CE432779390720'
   Attribute 177
(Mobility-Domain-Id) length=6
      Value: 1000
   Attribute 186
(WLAN-Pairwise-Cipher) length=6
      Value: 000fac04
   Attribute 187
(WLAN-Group-Cipher) length=6
      Value: 000fac04
   Attribute 188 (WLAN-AKM-Suite)
length=6
      Value: 000fac03
   Attribute 189
(WLAN-Group-Mgmt-Pairwise-Cipher) length=6
      Value: 000fac06
   Attribute 12 (Framed-MTU)
length=6
      Value: 1400
   Attribute 79 (EAP-Message)
length=39
      Value:
02da00251900170303001a000000000000000306566edd0b276a6168053b30b355df8bb39f
   Attribute 26 (Vendor-Specific)
length=8
      Value: 000030441e02
   Attribute 24 (State) length=18
      Value:
6874ad706faeb4a3ac603a7f29f4f267
45002.253 ba:b8:59:5a:af:fb <eh> RADIUS message (type=0) ==>
RADIUS Server code=1 (Access-Request) id=228 len=332
99232.253 Next RADIUS client retransmit in 3 seconds
99232.255 Reveived 104 bytes RADIUS message from authentication server
192.0.2.10:1812 by sock 11
RADIUS message: code=11 (Access-Challenge) identifier=228 length=104
   Attribute 79 (EAP-Message)
length=48
      Value:
01db002e19001703030023a4629322faef5fd3976552dcab7f2308bd05c3c1026ace89ace8c45dcb80d325b71b62
   Attribute 80
(Message-Authenticator) length=18
      Value:
0bdeae741d4d13c20101a243c65aa2c0
   Attribute 24 (State) length=18