Technical Tip: How to ensure FortiGate sends RADIUS Accounting packets to multiple servers

Description

This article describes how to provide the configuration steps necessary to ensure FortiGate can send RADIUS accounting packets to multiple accounting servers.

Scope

FortiGate.

Solution

FortiGate can generate RADIUS accounting messages for VPN clients or WiFi clients, and send them to RADIUS accounting servers.

It will send accounting packets to a configured accounting server if the following conditions are met:

• The user is subject to accounting authentication via a RADIUS server.
• The accounting server is configured within the RADIUS server object.

config user radius

    edit "FAC"

        set server "10.0.0.1"

        set secret ENC XXX

        set acct-interim-interval 600

        set auth-type ms_chap_v2

        config accounting-server

            edit 1

                set status enable

                set server "10.0.0.1"

                set secret XXX

                set port 1813

            next

            edit 2

                set status enable

                set server "192.18.1.99"

                set secret XXX

                set port 1813

            next

        end

    next

end

For the FortiGate to send interim updates, it must have first received an Accounting-Interim-Interval attribute from the accounting server, either during initial Access-Request/Access-Accept, or within the Accounting response.

More details can be found here, for example Technical Tip: Radius Accounting for SSL VPN Users

By default, FortiGate will only send to one accounting server, even if multiple accounting servers are configured.

There is a CLI setting to ensure FortiGate sends to all configured accounting servers:

(# config vdom)

(# edit <vdom>)

config user radius

edit <radius server>

set acct-all-servers enable

end