7.2.10 Breaks DUO Radius proxy

Hi gattac,

Thank you for reaching out. I assume this is relevant to changes done on 7.2.10 to mitigate against a radius vulnerability as described on release notes here:
https://docs.fortinet.com/document/fortigate/7.2.10/fortios-release-notes/5880/radius-vulnerability

You can try RADSEC which is tls authentication. An example to such deployment is on the following link:

https://docs.fortinet.com/document/fortigate/7.4.5/administration-guide/729374/configuring-a-radsec-client

Thank you,

saleha

@saleha 
Even feroz_ftnt's comment in this reddit thread is not clear. 
https://www.reddit.com/r/fortinet/comments/1fnrpf8/fortigate_200f_radius_response_fails_after/

Is this a problem triggered by FortiOS 7.2.10 started attaching Message-Authenticator(80) attribute and Duo doesn't reply with the correct attribute value after re-calculation, or just doesn't reply?
Or is this FortiOS 7.2.10's bug miscalculating the replied value from Duo?

The FGT GUI issue described in the thread has to be a separate issue only for the testing method because that doesn't involves actual user authentication incomplete.

Toshi

Hi @gattac 

Please refer to this KB: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-RADIUS-authentication-failure-after-the/ta-p/343112

So my conclusion for this issue based on last a couple of days of research over this community posts and Reddit posts, only solution with 7.2.10/7.4.5 or newer versions that would come out in the future is to set Duo Auth proxy to bypass Message-Authenticator attribute or all attributes to/from a backend auth server like Windows NPS/AD since Duo proxy itself doesn't support the attribute or TLS/RadSec at this moment.
https://help.duo.com/s/article/9014?language=en_US
https://help.duo.com/s/article/8930?language=en_US

Toshi

Hi Toshi_Esumi,

I hope the following clears up the information:
- FortiOS 7.2.10, 7.4.5 and future release 7.6.1 also require message-authentication attribute in radius setup with udp or tcp

- RADSEC or TLS is a way around this however it is currently not supported on DUO

- I have looked up DUO page and can only find them referencing pass-through options that includes message-authentication as provided at the following pages:
https://help.duo.com/s/article/7537?language=en_US
https://help.duo.com/s/article/9014?language=en_US

- I am not sure if the above articles apply to all kind of setup or just DUO proxy setup

- DUO according to the following announcement are actively investigating into allowing RADSEC authentication yes:

https://help.duo.com/s/article/8932?language=en_US

Thank you,

saleha

Just ran into this today after upgrading from 7.2.9 to 7.2.10, using Duo Auth Proxy as the RADIUS server. One effective workaround for this that I worked out is to switch from using ad_client as the authentication source for Duo, to using radius_client. Thanks Saleha for this link:

https://help.duo.com/s/article/9014?language=en_US

That put me on the right track to realize that if you pass through the Message Authenticator attribute to a patched MS NPS server, you'll get one back too, and it will satisfy the Fortinet requirement introduced in 7.2.10. If you don't already have NPS configured to serve RADIUS, you'll need to configure it. Then set up your Duo Auth Proxy like this:

**********************

[radius_client]
host=<ip address of your primary NPS server>
host_2=<ip address of your secondary NPS server>
secret_protected=<removed>
pass_through_all=true
retries=1

[radius_server_auto]
ikey=<removed>
skey_protected=<removed>
api_host=<removed>
radius_ip_1=<the IP or subnet of your devices that use Duo for RADIUS authentication>
radius_secret_protected_1=<removed>
failmode=secure
client=radius_client
port=1812
pass_through_all=true

*************************

You still need the [ad_client] section of the config file for synchronizing AD to the Duo cloud, but I didn't include it here because it doesn't change.

Note that pass_through_all is enabled for both the client and server section. I have my FortiGate configured to use MSCHAPv2 for the authentication type but I'm not sure that matters, as long as the NPS config is in agreement (note that if you do use MSCHAPv2 you also have to enable this registry setting on the NPS server and reboot):

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteAccess\Policy]
"Enable NTLMv2 Compatibility"=dword:00000001

Other than that, it's just a matter of setting up a RADIUS client on NPS that corresponds to your Duo Auth Proxy, and setting up a policy that allows access when the appropriate conditions are met (e.g. client friendly name, authentication type, Windows groups, etc).

Duo released version 6.4.2 to fix this:

Version 6.4.2 - October 21, 2024

• Adds the configuration option force_message_authenticator to radius_server modules.
  • Set force_message_authenticator to true to force the Authentication Proxy to include a message-authenticator attribute in reply packets.
• Ensures that reply packets containing a message-authenticator attribute send that as the first attribute.

Hi FortiUsr,

Thank you for the informative update. Here is the page from DUO reflecting what you mentioned about DUO version 6.4.2 or later supporting this change:
https://help.duo.com/s/article/9014?language=en_US

Thank you,

saleha