Troubleshooting Tip: 'RADIUS not enabled on device (Post-Auth)' issue for Ruckus SZ controller

Description

This article describes how to solve an issue with a Ruckus SZ controller which is configured to use FortiNAC as its RADIUS server.

Scope

FortiNAC.

Solution

Authentication is rejected with the message 'RADIUS not enabled on device (Post-Auth)':

(232) rest: Parsing attribute "Reply-Message"
(232) rest: EXPAND RADIUS not enabled on device (Post-Auth)
(232) rest:    --> RADIUS not enabled on device (Post-Auth)
(232) rest: Reply-Message := "RADIUS not enabled on device (Post-Auth)"
(232) Sent Access-Reject Id 215 from x.x.x.x:1812 to y.y.y.y:57591 length 84
(232)   Proxy-State = 0x3234
(232)   Reply-Message = "RADIUS not enabled on device (Post-Auth)"

The RADIUS server is enabled for the device, which can be confirmed from the GUI, and also from the CLI with the command 'device -ip x.x.x.x'. Look under 'Attribute Count' to see if RADIUS is enabled and the secret is configured:

fnac-1  # execute enter-shell                                                                                                                                           
fnac-1:~$ device -ip 10.x.x.x    <<<<< replace with IP of the controller
************************* Ruckus SZ Controller*************************
                     -------||-------                                                                 
                      output omitted
                     -------||-------
Attribute Count = 40
        Name = RadiusSecret *****
        Name = RadiusEnabled value = true length = 4
        Name = RadiusMode value = Local length = 5
Community Strings: ************* 
*****************************************************************

If all of the configurations look correct from the FortiNAC side, check the configuration on the Ruckus Smart Zone.

Enable RADIUS and make sure:

• Enable RADIUS Authentication.

• Enable RADIUS Accounting.

• Set NAS-IP.

Configuration from Ruckus side might look like below or similar:

Note: The NAS IP should use the IP of the Controller and not the AP. In the configuration page, choose use the SZ Control IP or manually configure it. If issues are still encountered, raise a Support ticket: Welcome to Fortinet Support