Skip to main content
heljag
Staff
heljag
Staff
June 19, 2026

Technical Tip: IPsec remote access VPN clients do not receive IP address from RADIUS server

  • June 19, 2026
  • 0 replies
  • 13 views

Description

This article describes a technical issue where IPsec Remote Access VPN clients do not receive an IP address from a RADIUS server. The user experiences this issue despite a successful VPN connection and proper RADIUS authentication.

Scope

FortiGate, FortiAuthenticator.

Solution

Diagram:

1f3f5239.png


The diagram represents the scenario in which a FortiClient connects via IPSec IKEv2 to a FortiGate (FortiAuthenticator handles authentication). Upon a successful authentication, FortiAuthenticator returns an AVP containing the Framed-IP-Address that FortiClient should use.

FortiGate configuration.

VPN IPsec:


config vpn ipsec phase1-interface
    edit "RA_USERS"
        set type dynamic
        set interface "port1"
        set ike-version 2
        set peertype one
        set net-device disable
        set mode-cfg enable
        set ipv4-dns-server1 192.168.200.23
        set proposal aes128-sha256 aes256-sha256 aes128gcm-prfsha256 aes256gcm-prfsha384 chacha20poly1305-prfsha256
        set dpd on-idle
        set dhgrp 20
        set eap enable
        set eap-identity send-request
        set transport udp-fallback-tcp
        set assign-ip-from usrgrp
        set psksecret ENC
        set dpd-retryinterval 60
    next
end

 

RADIUS:

config user radius
      edit "FAC"
          set server "192.168.200.144"
          set secret ENC
      next
  end

 

Group:

config user group
      edit "RA_Users"
          set member "FAC"
          config match
              edit 1
                  set server-name "FAC"
                  set group-name "SSLVPN_INTERNAL_USERS"
              next
          end
      next
  end

 

FortiAuthenticator configuration:

User:

b2d4fc89.png


Group:

d22b02d1.png


In FortiGate, the policy that allows the traffic is configured as follows:

24d8f878.png


When FortiClient connects, the tunnel is established. However, there is no IP address assigned.

83bc2fe6.png


In the fnbamd and ike debug commands, the following is visible:

Commands:

diagnose debug app fnbamd -1
diagnose debug app ike -1


Output:


2026-05-31 19:44:37 [595] __create_access_request-Created RADIUS Access-Request. Len: 258.
2026-05-31 19:44:37 [1175] fnbamd_socket_update_interface-vfid is 0, intf mode is 0, intf name is , server address is 127.0.0.1:1812, source address is null, protocol number is 17, oif id is 0
2026-05-31 19:44:37 [403] __rad_udp_send-oif=0, intf_sel.mode=0, intf_sel.name=
2026-05-31 19:44:37 [965] __rad_rxtx-Sent radius req to server 'EAP_PROXY': fd=12, IP=127.0.0.1(127.0.0.1:1812) code=1 id=32 len=258
2026-05-31 19:44:37 [974] __rad_rxtx-Start rad conn timer.
2026-05-31 19:44:37 [934] __rad_rxtx-fd 12, state 2(Challenged)
2026-05-31 19:44:37 [936] __rad_rxtx-Stop rad conn timer.
2026-05-31 19:44:37 [977] __rad_rxtx-
2026-05-31 19:44:37 [485] __rad_udp_recv-Recved 196 bytes. Buf sz 262144
2026-05-31 19:44:37 [1133] __rad_chk_resp_authenticator-The Message Authenticator validation is optional now
2026-05-31 19:44:37 [1156] __rad_chk_resp_authenticator-ret=0
2026-05-31 19:44:37 [1231] fnbamd_rad_validate_pkt-RADIUS resp code 2
2026-05-31 19:44:37 [1003] __rad_rxtx-
2026-05-31 19:44:37 [1301] fnbamd_rad_process-Result from radius svr 'EAP_PROXY' is 0, req 979371565061
2026-05-31 19:44:37 [549] fnbamd_rad_get_vsas-FORTINET group complete, val SSLVPN_INTERNAL_USERS
2026-05-31 19:44:37 [597] fnbamd_rad_get_vsas-FORTINET attr, type 255, val FAC
2026-05-31 19:44:37 [597] fnbamd_rad_get_vsas-FORTINET attr, type 253, val ipsec
2026-05-31 19:44:37 [931] fnbamd_radius_parse_mschapv2_attr-Decoding TYPE_MS_MPPE_Send_Key
2026-05-31 19:44:37 [843] __radius_decode_mppe_key-Key len after decode 16
2026-05-31 19:44:37 [920] fnbamd_radius_parse_mschapv2_attr-Decoding TYPE_MS_MPPE_Recv_Key
2026-05-31 19:44:37 [843] __radius_decode_mppe_key-Key len after decode 16
2026-05-31 19:44:37 fnbamd_dbg_hex_pnt[49] EAP msg from server (4)-03 6B 00 04
2026-05-31 19:44:37 [1437] fnbamd_rad_process-RADIUS auth succeeds with server 'FAC'
2026-05-31 19:44:37 [1503] fnbamd_rad_process-Challenged: 0, FTK_Challenge: 0, CHG_PWD: 0, Invaid_Digest: 0, No_Message_Authenticator_Attr: 0, State_Len: 0
2026-05-31 19:44:37 [631] fnbam_user_auth_group_match-req id: 979371565061, server: FAC, local auth: 0, dn match: 0
2026-05-31 19:44:37 [585] __group_match-Check if FAC is a group member
2026-05-31 19:44:37 [591] __group_match-Group 'RA-VPN_INTERNAL' passed group matching
2026-05-31 19:44:37 [594] __group_match-Add matched group 'RA-VPN_INTERNAL'(2)
2026-05-31 19:44:37 [585] __group_match-Check if FAC is a group member
2026-05-31 19:44:37 [585] __group_match-Check if FAC is a group member
2026-05-31 19:44:37 [585] __group_match-Check if FAC is a group member
2026-05-31 19:44:37 [585] __group_match-Check if FAC is a group member
2026-05-31 19:44:37 [206] find_matched_usr_grps-Passed group matching
2026-05-31 19:44:37 [912] update_auth_token_session-config does not require 2fa
2026-05-31 19:44:37 [239] fnbamd_comm_send_result-Sending result 0 (nid 0) for req 979371565061, len=2623
2026-05-31 19:44:37 2026-05-31 19:44:37.591766 ike V=DMZ:2:RA_USERS:167 EAP 979371565061 result FNBAM_SUCCESS
2026-05-31 19:44:37.591787 ike V=DMZ:2:RA_USERS: user 'ipsec' authenticated group 'RA-VPN_INTERNAL' 2
2026-05-31 19:44:37.591803 ike V=DMZ:2:RA_USERS: 0.0.0.0 is not an acceptable client IP address


Analyzing the capture between the FortiAuthenticator and the FortiGate, the AVPs are returned correctly:

  • User-Name: ipsec.

  • Framed-IP-Address: 192.178.238.210.

  • Fortinet-Group-Name: SSLVPN_INTERNAL_USERS.

d3ec09ab.png


This issue happens because the policy has a RADIUS and LDAP group in it.

When this configuration is used, 'EAP_PROXY' is used (FortiGate acts as an EAP proxy between the client and the RADIUS server).

This causes an issue with the AVP, specifically the Framed-IP-Address. Changing the policy by removing the LDAP group results in this.

Policy:

010fc451.png


FortiClient:

fad2ec16.png


a1a77879.png


2026-05-31 19:42:21 [334] __create_access_request-Compose RADIUS request
2026-05-31 19:42:21 fnbamd_dbg_hex_pnt[49] EAP msg from client (6)-02 6E 00 06 1A 03
2026-05-31 19:42:21 [595] __create_access_request-Created RADIUS Access-Request. Len: 157.
2026-05-31 19:42:21 [1175] fnbamd_socket_update_interface-vfid is 2, intf mode is 0, intf name is , server address is 192.168.200.144:1812, source address is null, protocol number is 17, oif id is 0
2026-05-31 19:42:21 [403] __rad_udp_send-oif=0, intf_sel.mode=0, intf_sel.name=
2026-05-31 19:42:21 [965] __rad_rxtx-Sent radius req to server 'FAC': fd=10, IP=192.168.200.144(192.168.200.144:1812) code=1 id=22 len=157
2026-05-31 19:42:21 [974] __rad_rxtx-Start rad conn timer.
2026-05-31 19:42:21 [934] __rad_rxtx-fd 10, state 2(Challenged)
2026-05-31 19:42:21 [936] __rad_rxtx-Stop rad conn timer.
2026-05-31 19:42:21 [977] __rad_rxtx-
2026-05-31 19:42:21 [485] __rad_udp_recv-Recved 200 bytes. Buf sz 262144
2026-05-31 19:42:21 [1133] __rad_chk_resp_authenticator-The Message Authenticator validation is mandatory now
2026-05-31 19:42:21 [1156] __rad_chk_resp_authenticator-ret=0
2026-05-31 19:42:21 [1231] fnbamd_rad_validate_pkt-RADIUS resp code 2
2026-05-31 19:42:21 [1003] __rad_rxtx-
2026-05-31 19:42:21 [1301] fnbamd_rad_process-Result from radius svr 'FAC' is 0, req 979371565059
2026-05-31 19:42:21 [530] fnbamd_rad_get_vsas-FORTINET attr, type 1, val SSLVPN_INTERNAL_USERS
2026-05-31 19:42:21 [931] fnbamd_radius_parse_mschapv2_attr-Decoding TYPE_MS_MPPE_Send_Key
2026-05-31 19:42:21 [843] __radius_decode_mppe_key-Key len after decode 16
2026-05-31 19:42:21 [920] fnbamd_radius_parse_mschapv2_attr-Decoding TYPE_MS_MPPE_Recv_Key
2026-05-31 19:42:21 [843] __radius_decode_mppe_key-Key len after decode 16
2026-05-31 19:42:21 fnbamd_dbg_hex_pnt[49] EAP msg from server (4)-03 6E 00 04
2026-05-31 19:42:21 [1503] fnbamd_rad_process-Challenged: 0, FTK_Challenge: 0, CHG_PWD: 0, Invaid_Digest: 0, No_Message_Authenticator_Attr: 0, State_Len: 0
2026-05-31 19:42:21 [631] fnbam_user_auth_group_match-req id: 979371565059, server: FAC, local auth: 0, dn match: 0
2026-05-31 19:42:21 [585] __group_match-Check if FAC is a group member
2026-05-31 19:42:21 [591] __group_match-Group 'RA-VPN_INTERNAL' passed group matching
2026-05-31 19:42:21 [594] __group_match-Add matched group 'RA-VPN_INTERNAL'(2)
2026-05-31 19:42:21 [585] __group_match-Check if FAC is a group member
2026-05-31 19:42:21 [585] __group_match-Check if FAC is a group member
2026-05-31 19:42:21 [585] __group_match-Check if FAC is a group member
2026-05-31 19:42:21 [206] find_matched_usr_grps-Passed group matching
2026-05-31 19:42:21 [912] update_auth_token_session-config does not require 2fa
2026-05-31 19:42:21 [239] fnbamd_comm_send_result-Sending result 0 (nid 0) for req 979371565059, len=2628
2026-05-31 19:42:21 2026-05-31 19:42:21.522909 ike V=DMZ:2:RA_USERS:165 EAP 979371565059 result FNBAM_SUCCESS
2026-05-31 19:42:21.522930 ike V=DMZ:2:RA_USERS: user 'ipsec' authenticated group 'RA-VPN_INTERNAL' 2
2026-05-31 19:42:21.522948 ike V=DMZ:2:RA_USERS: assigned IP 192.178.238.210


By removing the LDAP group, fnbamd passthrough via the EAP goes directly to the FortiAuthenticator instead of passing through the 'EAP_PROXY', and the Framed-IP-Address is assigned correctly to the FortiClient.

    Terms & ConditionsAccessibility statement