FGT Can't contact RADIUS server FAC

Forum|Forum|1 year ago
January 17, 2025
6 replies
3682 views

Hello yesterday I configured my FAZ to use our FAC as radius server which worked #1, todya I try to do the same thing for our FGT but I always get the "Can't contact RADIUS server". Radius client and policies are done the same way.

If I delete the policy and the client form the FAC and do a connectivity test on the FGT Radius config and I look in the FAC /debug wbe page I see a request with the error of unkkown client which is normal, but as soon as I create the client and the policy for it in my FAC and retest from the FGT which is failing I get no more logs in the /debut page of the FAC so I'm a bit confuse at what am I missing to get this to work.

rbraha

Staff

Hi @J2B4U

Make sure first that secret between FAC and FGT are correct, additionally if you are using FGT 7.2.10 version ,FAC should be upgraded to version 6.6.2, make sure that you can specify in CLI to set source IP which radius server can be reached or interface that can be used

config user radius
edit radius server name
set source-ip ''
set interface-select-method auto

If getting other error like No message Authenticator ,follow the guide below.

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-RADIUS-authentication-failure-after-the/ta-p/343112

J2B4UAuthor

Visitor III

FGT is in 7.2.9 and FAC in 6.6.2, secret is good

J2B4UAuthor

Visitor III

@rbraha I found the problem thanks for your link, on the FAC in the client I enabled "Require client to send Message-Authenticator attribute" and I'm in version 7.2.9 not 7.2.10 so I disable the features and it worked right away. Since my FAZ is at the latest version it was working with this feature enabled and I just replicated the same config for my FGT.

J2B4UAuthor

Visitor III

Now that communication between FGT and FAC radius is working when I try to login, enter my credential and then FGT is asking for my token, but after giving my token I get an access denied ¯\_(ツ)_/¯

Hosemacht

Explorer

Hey there,

there is a known issue with radius between FGT and FAC, and therefore you have to enable "Require client to send Message-Authenticator attribute" on the FAC (a new feature introduced in v6.6.2 to mitigate CVE-2024-3596)

See: RADIUS authentication failure after the f... - Fortinet Community

UPDATE: sorry i didnt saw you where already informed about this issue in the first time.