Technical Tip: The RADIUS auth-type 'ms_chap_v2' for 802.1x profile will not apply to the FortiSwitch

When the FortiGate needs to apply 802.1X authentication to the managed FortiSwitch, the FortiGate pushes the Radius

configuration via security-policy 802.1X on the FortiSwitch.

If the RADIUS auth-type is 'ms_chap_v2', the FortiGate will not sync the correct auth-type to the FortiSwitch.

Below is an example:

1. Change the auth-type on FortiGate:

FGT# show
config user radius
    edit "1"
        set server "10.56.241.*"
        set secret ***
        set auth-type pap
    next
end

FGT# set auth-type ms_chap_v2 <--------- Change to ms_chap_v2.

FGT# end

2. Checking the debug log on the FortiGate:

FGT# diagnose debug application flcfgd -1
Debug messages will be on for 30 minutes.
"name":"1",
    "q_origin_key":"1",
    "server":"10.56.241.***",
    "secret":"ENC DEtzTJhW5N8VfSAHBxV\/c8ZSBP9EAasuCe+YSjVmWJsKEkWa3KVibOeXU+h2Pnlcf3ctBRVBrHrUy4

SKeytT4i+0L7aWCkobNzfo2zoGdz3Q2tsKKsatNhFrVqazoR7DVrW9PT1\/D9ZuIX
TVXUgzFjS+IsN8ukarBWFV59EPPZ1x0Tl2",
    "secondary-server":"",
    "secondary-secret":"ENC VAL6QGL4MAChCLIPnEDWPkUgvL\/HRFoRo96OE0JBgF+\/zDPnhdOvUAmWgrQrVhXNudmM

5DiyGwDmrWXK3y2kuvkwA+UslujT3ZTXMtrjv1id2fF7mksCHWsl4TDhnsvmRSZG
ro+wkS3C3+6xLaGzZ56GEU5DOHD3Zmjl32ieR6m2gasL",
    "all-usergroup":"disable",
    "nas-ip":"0.0.0.0",
    "nas-ip6":"::",
    "acct-interim-interval":600,
    "acct-fast-framedip-detect":2,
    "frame-mtu-size":1500,
    "service-type":"",
    "radius-port":1812,
    "auth-type":"ms_chap", <--------------------------------- It should be ms_chap_v2.
    "addr-mode":"ipv4",
    "source-ip":"0.0.0.0",
    "source-ip6":"::",
    "link-monitor":"disable",
    "link-monitor-interval":15,
    "radius-coa":"disable",
    "radius-coa-secret":"ENC Ty8f4xbf3e0tfSrhv4J3vUGJMGymK\/s6HZDxT0iCmRKma\/45MRzS+JA0aHOEtZBn+vEwyoeN\/u5K9AJFXsh\/

qAwzMxpllsS3O3o30ifLZ6HGomlLiLY6fWEyo8xuhxTwL
cLXwOeVL\/+stf9NACVWLeY4NH7muho1c++FRUVTCSu\/D02y",
    "acct-server":[
    ]
  },

3. Checking the FortiSwitch debug log:

S108FPTV24007*** # diagnose debug cli 8

S108FPTV24007*** # diagnose debug en
zip config file /data/./config/sys_vd_root.conf.gz success!
0: config user radius
0: edit "1"
0: set auth-type ms_chap <--------------------- FortiSwitch received ms_chap config from FortiGate.
0: end
0: config user radius
0: edit "2"
0: end
open file 10 to write config
write config file success, prepare to save in flash
zip config file /data/./config/sys_vd_root.conf.gz success!

The workaround is to manually modify the auth-type on the FortiSwitch.

This issue will be fixed in FortiOS version 7.6.5.