Skip to main content
cmaheu
Staff
cmaheu
Staff
May 6, 2020

Technical Tip: RADIUS processing stops in distributed deployment

  • May 6, 2020
  • 0 replies
  • 988 views

Description

 
This article describes that during the RADIUS authentication process, certain lookups occur between the managed appliance and the Control Manager (NCM). The processing of RADIUS traffic can be delayed or timeout if network communication with the Control Manager is slow or inconsistent (for example: appliance communicating to the Manager over a slow WAN connection).


Scope


Version:  8.5.3, 8.6.1, 8.7.0 and above.

Solution


Addressed in 8.6.4 and 8.7.2 with an additional step of modifying a property file to disable remote host lookups for RADIUS authentication.  For assistance, contact Support.

Note.
The steps below instruct modifying the property file prior to upgrading.  The modification of this file can be done either before or after the upgrade, however, an additional restart of processes on every Primary Control Server will be required if modified after.

 
The following steps must be performed on each Server/Control Server managed by the Control Manager.
  1. Log in to CLI as root.
  2. Go to the /bsc/campusMgr/master_loader directory.
  3. Use an editor such as VI to open the .masterPropertyFile file.
  4. Add the following entry and save the file:

    FILE_NAME=./properties_plugin/radiusManager.properties

    {
    com.bsc.plugin.radius.RadiusServer.disableRemoteClientLookups=true
    }

     

  5. Upgrade appliances. For details, refer to the Upgrade Instructions and Considerations guide in the Fortinet Document Library.

  6. The radiusManager.properties file should now reflect the changes.  To view, login to the appliance CLI and type:

cat /bsc/campusMgr/master_loader/properties_plugin/radiusManager.properties | grep disableRemoteClientLookups

 

Modifying file after upgrade.
 
If the upgrade was performed first, follow the below instructions on every managed Primary Control Server:
 
  1. Modify the file as described above (steps 1-4).

  2. Stop processes. Type.

    shutdownNAC

  3. Wait 30 seconds.

  4. Start processes. Type.

    startupNAC

  5. The radiusManager.properties file reflects now the changes.  To view, login to the appliance CLI and type:

cat /bsc/campusMgr/master_loader/properties_plugin/radiusManager.properties | grep disableRemoteClientLookups

Terms & ConditionsAccessibility statement