Skip to main content
SC_Alex
SC_Alex
New Member
April 30, 2024
Solved

FG 60F fails to proceed CoA request

  • April 30, 2024
  • 4 replies
  • 5908 views

Hello, 

I faced a problem, that some time ago stopped working CoA Disconnection
If I do: 
echo "User-Name=Username, Framed-IP-Address=10.0.0.X" | radclient -x name.fortidyndns.com:3799 disconnect Secret

The router receives packet on wan interface, i see it with packet capture tool on port 3799
L4 Length 43 Checksum 0xb86a

But not performs anything. 

On LocalIn Policy I see that 

Custom Application UDP any 3799 Accept

On corresponding wan port Radius accounting is enabled. Plus it was working few days ago. 


I suppose it could get broken after I put both wan interfaces into SD-WAN, but not sure. 
On 2nd device FG-61F there is same thing happens. Both have version 7.4.3

config user radius
edit "Radius"
set server "y.y.y.y"
set secret Secret
set nas-ip x.x.x.x
set acct-interim-interval 60
set radius-coa enable
set auth-type pap
set acct-all-servers enable
config accounting-server
edit 1
set status enable
set server "y.y.y.y"
set secret Secret
set port 1813
set source-ip "x.x.x.x"
next
end
next
end

Any ideas how to diagnose / fix this are highly appreciated

Best answer by SC_Alex

The problem is solved.
It was in test enviroinment. We have changed password for client (client.conf):
client 192.168.1.20 {
ipaddr = 192.168.1.20
secret = testing123
coa_server = {
secret = testing124
port = 3799
}
}


But connection test in FG showed ok with old passwords was kept for authentication and accounting, so this caused bad checks of this part from our side.

Meanwhile seems like coa password is received by FG from RADIUS server when they exchange auth/accounting information (not sure exactly which one). And only with this password disconnection works well. So after we updated secret for radclient, it became fully functional again. 

I would suggest adding more detailed description of coa functionality to FG docs. 

4 replies

adambomb1219
SuperUser
adambomb1219
SuperUser
April 30, 2024

What is the RADIUS server?   Why are you sending RADIUS over the WAN?  Is it over an IPSec tunnel I hope?  What is the CoA for?  Managed switch?  Managed AP?  FortiClient SSL VPN?

SC_Alex
SC_AlexAuthor
New Member
April 30, 2024

It is freeradius. 
It is a test config, so we use WAN now. 
CoA is for router, it has to disconnect clients connected via Firewall Group. 
They are connected via wifi ap, in a dedicated vlan. 
I tested without SD-WAN, result is the same. 

AEK
SuperUser
AEK
SuperUser
April 30, 2024

Did you say in your first post it worked before you configure SD-WAN or it actually doesn't work without SD-WAN?

AEK
ebilcari
Staff
ebilcari
Staff
May 1, 2024

You have to check that after the interface/routing changes, same IP is used and there is no NAT applied, RADIUS communication using different IP will get ignored both from NAS or the server.

To get more details for the CoA you can enable this debug on FGT:

diag debug app radius-das 8

Emirjon
SC_Alex
SC_AlexAuthor
New Member
May 1, 2024

I enabled this and closed cli, but can't find how to check the results

ebilcari
Staff
ebilcari
Staff
May 1, 2024

The output will come on the CLI in real time, you have to also enable the debugs with:

diag debug enable

and this command to record also the timestamps (if needed to crosscheck)

diag debug console timestamp enable

Emirjon
SC_Alex
SC_AlexAuthor
New Member
May 3, 2024

Seems like the problem is wider: 
FG does not accepts any packets, even if we try sending CoA request from internal interface (LAN). 

 

It also see incoming packet but FG does nothing with it, not replies at all. 
I'm confused. 

SC_Alex
SC_AlexAuthorAnswer
New Member
May 4, 2024

The problem is solved.
It was in test enviroinment. We have changed password for client (client.conf):
client 192.168.1.20 {
ipaddr = 192.168.1.20
secret = testing123
coa_server = {
secret = testing124
port = 3799
}
}


But connection test in FG showed ok with old passwords was kept for authentication and accounting, so this caused bad checks of this part from our side.

Meanwhile seems like coa password is received by FG from RADIUS server when they exchange auth/accounting information (not sure exactly which one). And only with this password disconnection works well. So after we updated secret for radclient, it became fully functional again. 

I would suggest adding more detailed description of coa functionality to FG docs. 

Terms & ConditionsAccessibility statement