Authenticate FortiAP via FortiGate to RADIUS with computer certificates

Hi,

Could you please do "show user radius" in your FGT and then test its connectivity?

For example:

FW90DP3Z14003488 (root) # show user radius config user radius     edit "PEAP"         set server "172.16.200.33"         set secret ENC ... ...     next end FW90DP3Z14003488 (root) # diagnose test authserver radius PEAP mschap2 tester 123456 authenticate 'tester' against 'mschap2' succeeded, server=primary assigned_rad_session_id=781115654 session_timeout=0 secs idle_timeout=0 secs!

Please also show your SSID configuration.

>> Computers get their certificates automatically from our Enterprise CA and the RADIUS Server validates them and grants Access.

Haven't those computers (or WiFi stations?) saved their client certificates as well as the CA in local hard drive already, before associate with the SSID?

Is EAP-TLS used as WiFi authentication method by them?

Thanks,

Mike

asapHO wrote:

Hi Community,

 

I'm stuck with a Problem that I cannot solve - maybe someone can help me out.

 

SCENARIO:

Using Wireless LAN within a corporate Environment and authenticate users with certificates

 

GOAL:

Using FortiAPs controlled by a FortiGate to authenticate Computers with their Computer certificate against an existing Windows NPS (Radius) implementation.

 

First of all - I do have a working LANCOM deployment within our Environment which works exactly like it is supposed to be.

So we have a working Windows Enterprise CA and a working NPS deployment.

 

I can authenticate with the FortiGate Unit against our RADIUS Server (FortiGate says it is working) - so I've activated the WiFi Controller Feature and linked two FortiAP321C Units. I've created a SSID with a local Bridge to the fortiAPs Interface. Selected WPA2 Enterprise and the Radius Server I've configured.

 

I cannot get the Windows Clients to authenticate (using the same NPS Profile like the LANCOM APs) with the FortiAP and I don't know what the Problem might be. Using the "old" LANCOM structure (with similar Settings) it is working like a charm (but I have to mention, that in a LANCOM deployment every AP is querying the RADIUS Server). So Computers get their certificates automatically from our Enterprise CA and the RADIUS Server validates them and grants Access.

 

I haven't found a cookbook mentioning this Scenario so has anybody built this and can help me out?

Any Feedback is appreciated!

 

Thanks and best regards...

Hi,

I am also interested in an 802.1x deployment with FGT and fortiap , I have checked the latest fortigate document but cant seem to find a section of this . I believe this feature is not documented by fortigate even though its supported and because of lack of documentation I am unsure to which extent is this supported and what are the limitations . In such cases I would need to do a hit and test couple of times before bringing up a successful implementation .

please correct me if i am wrong.