Troubleshooting Tip: Configure and troubleshoot 802.1x authentication on a Managed FortiSwitch

5. Create a policy from CLI to allow RADIUS service. The incoming interface is the FortiLink interface and the outgoing interface is where the RADIUS server is connected.
   
   

config firewall policy
    edit 1
        set srcintf "MCLAG"    <----- This is the FortiLink interface in the example.
        set dstintf "port1"    <----- This is the LAN interface where the RADIUS server is.
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "RADIUS"
        set nat enable
end

Verify the config from CLI:

FortiGate.

FGT # show user radius
config user radius
    edit "FCT"
        set server "10.33.165.61"
        set secret ENC H00GGt2qjDdIX4IuNyLM3Yj3kHr41qZ0zR5dyqQabYEANROYf1E2qmsev3NSG1GjC14TlXLah5f5NtlPlms9N3QighfenoKNK9pCccVtxkqnTLua5dBuUVJb2GMFsz44jYh/WPg6m0yZMrk+0knVDQJDgLkOP6vT4OvZ+dmi30tXUJ1cAg3EBPLAFdVktncex0NSQQ==
        set nas-ip 10.33.154.24
    next
end

FGT # show user group FCT
config user group
    edit "FCT"
        set member "FCT"
    next
end

FGT # show switch-controller security-policy FCT
config switch-controller security-policy 802-1X
    edit "FCT"
        set user-group "FCT"
        set mac-auth-bypass disable
        set open-auth disable
        set eap-passthru enable
        set guest-vlan disable
        set guest-auth-delay 20
        set auth-fail-vlan disable
        set radius-timeout-overwrite disable
    next
end

FGT # show switch-controller managed-switch S248EXXXX
config ports
    edit "port1"
        set poe-capable 1
        set vlan "vsw.MCLAG"
        set untagged-vlans "qtn.MCLAG"
        set port-security-policy "FCT" --> Make sure the policy is configured to allow the RADIUS service.

FGT # show firewall policy 1
config firewall policy
    edit 1
        set name "all"
        set uuid 7106aed8-febd-51e8-8dd0-417720452421
        set srcintf "MCLAG"
        set dstintf "port1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "RADIUS"
        set fsso disable
        set nat enable
    next
end

Verify if the config is pushed to FortiSwitch:
SSH into the switch from the FortiGate:

FGT# execute ssh admin@<switchip>
switch # show user radius
config user radius
    edit "FCT"
        set nas-ip 10.33.154.24
        set radius-port 0
        set secret ENC pEyknaQHimLcfLt2p/kdj7hTC8Q0mnSDgMA9odIQgzHRXEgulaob+NV9kO07qUxHBg1WbQK4iVQfvEtkx6VLl0qwiehzL8o1d4lIDXDgYAvaA/HEjL2gEV6atns2xos5HKulJjXrAEWixCQzECudHrv0ufhK0ffKQqVZWg4x2PdbSJx/
        set server "10.33.165.61"
    next
end

switch # show user group
config user group
    edit "FCT"
        set member "FCT"
    next

switch # show switch interface port1
config switch interface
    edit "port1"
        set untagged-vlans 4093
        set security-groups "FCT"
        set snmp-index 1
            config port-security
                set auth-fail-vlan disable
                set eap-passthru enable
                set framevid-apply enable
                set guest-auth-delay 30
                set guest-vlan disable
                set mac-auth-bypass disable
                set open-auth disable
                set port-security-mode 802.1X
                set radius-timeout-overwrite disable
                set auth-fail-vlanid 200
                set guest-vlanid 100
            end
    next
end

Now, connect a client to the switch port and attempt to perform 802.1x authentication.

Windows client supplicant settings example: