Technical Tip: Workaround to configure more than two Eduroam FLR servers on FortiNAC-F
Description
This article describes a workaround that allows an administrator to configure more than two Eduroam FLR (Federated Login Router) servers on a RADIUS Service Connector in FortiNAC-F.
Scope
FortiNAC-F 7.6.x (prior to 7.6.8). Applies to any deployment participating in eduroam where more than two FLR servers are required.
Solution
A helper script, 'set_flr.sh', sets flrPriority with ordering across the Eduroam FLR servers via the REST API. The script, the access token, and the server IDs are the only inputs required.
How to configure more than two Eduroam FLR servers:
Create an admin user with REST API access
Create an administrator account with Allow REST API Access enabled, and save the access token it generates. This token is passed to the script in Step 2.
Admin user with Allow REST API Access.
Create an admin user with Allow REST API Access and save the access token.
Deploy and run set_flr.sh
Deploy set_flr.sh to the FortiNAC-F appliance and run it with the access token and the Eduroam FLR server IDs. Obtain each server ID by opening the corresponding RADIUS server in the GUI:
bash /tmp/set_flr.sh <access_token> <id1> <id2> <id3> <id4>
Deploy and run set_flr.sh with token and server IDs.
Run set_flr.sh with the access token and Eduroam FLR server IDs.
set_flr.sh output with server names printed.
Script output prints the server names alongside the configured priorities.
Verify the result:
Confirm the configuration took effect across the following layers:
First the NAS table — the FreeRADIUS NAS table allows requests from all FLR server IPs.
NAS table allows requests from FLR servers.
Then the flrPriority in the database — the DB stores the priority values written by the script.
flrPriority values in the database.Database query showing flrPriority set across the FLR servers.
Finally, the GUI rendering - the Service Connector row renders with priority -> 2.
Service Connector rendering with FLR priority -> 2RADIUS Service Connector row rendered with FLR priority greater than 2.
How to remove a server from the Eduroam FLR pool:
To remove a server from the Eduroam FLR pool, open the RADIUS Service Connector row and select No at the Eduroam FLR control for that server.
Select No at Eduroam FLR to remove a server from the pool.
Set new Eduroam FLR servers:
To set new FLR servers, first reset all Eduroam FLR servers (select No at Eduroam FLR for every member) and then re-run set_flr.sh
Reset all Eduroam FLR servers (select No) before re-running the script.
Note:
If the new count is equal to or greater than the old count, re-running set_flr.sh overwrites the existing configuration. - If the new count is less than the old count, reset all Eduroam FLR servers (select No at Eduroam FLR) before re-running the script.
Important caveat — delete-and-re-add resets flrPriority:
Deleting and re-adding an FLR service connector in the GUI resets flrPriority to -1. This limitation is scheduled to be addressed in FortiNAC-F 7.6.8. Until then, all future FLR edits must go back through set_flr.sh after any GUI delete-and-re-add. Opening a row in the GUI and clicking Save without touching the FLR radio is safe — the flrPriority value is preserved.
Background / limitation:
FortiNAC-F only lets an admin designate a Primary + Secondary FLR server on the RADIUS Service Connector GUI.
Federations operating more than two FLR nodes can experience dropped inbound identity-provider traffic from FLR servers that cannot be registered through the GUI.
The two-server limitation is enforced by the FortiNAC-F GUI. The underlying configuration supports additional FLR servers.
Everything downstream already handles N members, so the workaround below uses the REST API to write flrPriority values beyond the GUI cap.
RADIUS request accepted with flrPriority=4
RADIUS Access-Request from a server with flrPriority=4 is accepted by FortiNAC (end-to-end test).
