Skip to main content
js2
Staff
js2
Staff
March 20, 2025

Technical Tip: The AP of portal policy does not contain client error

  • March 20, 2025
  • 0 replies
  • 349 views
Description

This article describes the possible reasons that can cause the error where the AP of portal policy does not contain the client.
Scope FortiAuthenticator.
Solution

Radius debug:

 

2025-02-25T17:56:15.101000+05:30 FortiAuthenticator radiusd[2909]: (29) facauth: facauth: recv Access-Request from 127.0.0.1 port 48951, id=2, length=138
2025-02-25T17:56:15.101011+05:30 FortiAuthenticator radiusd[2909]: User-Name = "918668135962"
2025-02-25T17:56:15.101266+05:30 FortiAuthenticator radiusd[2909]: NAS-IP-Address = 127.0.0.1
2025-02-25T17:56:15.101287+05:30 FortiAuthenticator radiusd[2909]: NAS-Port = 20
2025-02-25T17:56:15.101298+05:30 FortiAuthenticator radiusd[2909]: NAS-Identifier = "FAC_GUEST:13:fac.joshi.in"
2025-02-25T17:56:15.101305+05:30 FortiAuthenticator radiusd[2909]: User-Password: ******
2025-02-25T17:56:15.101313+05:30 FortiAuthenticator radiusd[2909]: Calling-Station-Id = "e1:cf:86:ac:01:40"
2025-02-25T17:56:15.101322+05:30 FortiAuthenticator radiusd[2909]: Framed-IP-Address = 40.41.240.30
2025-02-25T17:56:15.101332+05:30 FortiAuthenticator radiusd[2909]: Message-Authenticator = 0xf8ec2c6481e7b1be2824c8e33b41acda
2025-02-25T17:56:15.101343+05:30 FortiAuthenticator radiusd[2909]: Event-Timestamp = "Feb 25 2025 17:56:15 IST"
2025-02-25T17:56:15.101352+05:30 FortiAuthenticator radiusd[2909]: (29) facauth: ===>NAS IP:127.0.0.1
2025-02-25T17:56:15.101362+05:30 FortiAuthenticator radiusd[2909]: (29) facauth: ===>Username:918668135962
2025-02-25T17:56:15.101376+05:30 FortiAuthenticator radiusd[2909]: (29) facauth: ===>Timestamp:1740486375.99971, age:1ms
2025-02-25T17:56:15.102195+05:30 FortiAuthenticator radiusd[2909]: (29) facauth: ERROR: The AP of portal policy 13 does not contain client fac.joshi.in

 

Possible use cases for this error to trigger:

  1. An auth request comes from an unknown AP.
  2. NAS Identifier received the client as 'fac.joshi.in' however Access point was configured for IP instead of FQDN.
  3. If the auth portal address is configured additionally on FortiGate and deployed with IP in the Access point of FortiAuthenticator.

 

config firewall auth-portal
    set portal-addr 'fac.joshi.in'
end

 

    Terms & ConditionsAccessibility statement