Skip to main content
robinh007
robinh007
Explorer III
March 14, 2025
Solved

Creation of Custom VSA

  • March 14, 2025
  • 3 replies
  • 1376 views

We are planning to utilize a RADIUS server for LDAP and OTP authentication. Our objective is to send the Username, Password, and OTP in a single request. To achieve this, we need to create a Custom Vendor-Specific Attribute (VSA) in the FortiGate firewall. This will enable us to include the OTP along with the Username and Password for authentication purposes. Could you please provide the detailed procedure for creating a Custom VSA in the FortiGate firewall?

 

FortiGate 

Best answer by dingjerry_FTNT

Hi @robinh007 ,

 

I am unfamiliar with Radius and have never heard of including a Username, Password, and OTP in one Radius request.

 

Here is the article about Fortinet's RADIUS Dictionary and VSAs (latest):

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Fortinet-s-RADIUS-Dictionary-and-VSAs-latest/ta-p/194896

 

 

3 replies

Stephen_G
Moderator
Stephen_G
Moderator
March 16, 2025

Hello,


Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.


Thanks,

Stephen_G - Fortinet Community Team
    dingjerry_FTNT
    Staff
    dingjerry_FTNTAnswer
    Staff
    March 16, 2025

    Hi @robinh007 ,

     

    I am unfamiliar with Radius and have never heard of including a Username, Password, and OTP in one Radius request.

     

    Here is the article about Fortinet's RADIUS Dictionary and VSAs (latest):

     

    https://community.fortinet.com/t5/FortiGate/Technical-Tip-Fortinet-s-RADIUS-Dictionary-and-VSAs-latest/ta-p/194896

     

     

      AEK
      SuperUser
      AEK
      SuperUser
      March 17, 2025

      I think it depends on the authentication protocol (PAP, CHAP, MSCHAP2 & EAP). Some support challenge response, some support concatenated password-OTP and some may support both.

      AEK
        robinh007
        robinh007Author
        Explorer III
        March 20, 2025

        We have defined the protocol as PAP in our radius server. 

        AEK
        SuperUser
        AEK
        SuperUser
        March 20, 2025

        PAP is insecure but it supports password-token concatenation.

        AEK
          Terms & ConditionsAccessibility statement