Technical Tip: Configure RADIUS on FortiGate with specific source interface

v7.6.x:

1. Go to Users & Authentication -> RADIUS Servers.
2. Select the specific server.
3. Select Edit and select the Advanced tab.
4. In the Source Interface section, select the new interface expected for the RADIUS requests to come from.

v7.4.x and prior:

It is configurable only over the CLI. These are the required commands:

config user radius
    edit "RADIUS_Server_Name"

        set interface-select-method specify 
        set interface "interface_name"
    next
end

Note:
Make sure that the new interface selected is up and running with a valid IP address. Routing should be active with that interface to send the traffic; otherwise connection will fail.

There is another option to specify the source interface. 

Method 2:

1. Navigate to Network -> Local Out Routing.
2. Select the RADIUS Server -> Edit.
3. Mention the Outgoing interface as Specify, select the interface preferred for the RADIUS traffic to exit.
4. Select OK to save the changes.

To test the connectivity, place a capture with the configured RADIUS port:

diagnose sniffer packet any 'host [radius-srv-ip] and port (1812 or 1813)' 4 0 l

To get more information regarding the reasons for authentication failure, use the following CLI commands:

diagnose debug enable

diagnose debug console timestamp enable
diagnose debug application fnbamd -1

diagnose debug application radiusd -1

To stop this debug type:

diagnose debug application fnbamd 0

Related article:
Troubleshooting Tip: RADIUS authentication troubleshooting