Troubleshooting Tip: How to troubleshoot FortiNDR RADIUS authentication failures
Description
This article describes basic troubleshooting steps and required debug commands when RADIUS authentication fails on FortiNDR.
Scope
FortiNDR v7.6.x.
Solution
Enable authentication debug logs.
Run the following commands to capture detailed authentication debugging for a failed session:
These commands will:
Enable debug mode
Provide detailed logs from the authentication daemon (
authd).Help identify issues as mentioned in the screenshot below, such as: Invalid credentials, Server communication failures, Timeout issues, Policy mismatches.
Capture RADIUS Traffic (Packet Sniffer).
At the same time, run a packet capture to verify communication with the RADIUS server:
This will:
Capture RADIUS authentication traffic (UDP port 1812).
Show request/response flow between FortiNDR and the RADIUS server.
Help to identify: No response from server, Incorrect IP/port configuration, Network connectivity issues, Packet drops or delays.
Analysis.
RADIUS request and response are observed.
Confirms: Network connectivity is working and the RADIUS server is reachable.
This indicates the issue is not network-related, but related to authentication validation.
Disable authentication debug logs.
Additionally, when selecting from FortiNDR GUI log & report -> Events -> User failed, as mentioned in the screenshot below.
