Skip to main content
tobisfr
tobisfr
Explorer
May 13, 2025
Question

FortiAuthenticator - MAC based Radius "invalid User" before successfull Login

  • May 13, 2025
  • 6 replies
  • 1541 views

Hi,

 

we just implementing FortiAuthenticator Version 6.6.3 as radius server together with our HP Aruba / Procurve Switches. I configured MAC-Based Authentication on the switches:

 

aaa authentication mac-based chap-radius server-group "FAC"

aaa port-access mac-based 2-19

 

On FortiAuthenticator Site I

- created the devices under User Management --> MAC Devices

- registered the switch as radius client und created a Mac Authentication ByPass Policy

 

The authentication works by I always have an error before the successfull authentication. If the Client is connected:

 2025-05-13T09:00:14.065119+02:00 facauth: Updated auth log '606d3ca7ee62' for attempt from 10.10.1.116: user authentication error: invalid user

2025-05-13T09:00:14.068143+02:00 facauth: Updated auth log 'B20195042' for attempt from 10.10.1.116: MAC-based authentication successful

 

Am I doing anything wrong in the config.

 

 

2025-05-13T09:00:14.062802+02:00 FortiAuthenticator-BA radiusd[1488]: (4767) facauth: facauth: recv Access-Request from 10.10.1.116 port 1812, id=39, length=367  2025-05-13T09:00:14.062807+02:00 FortiAuthenticator-BA radiusd[1488]:         Framed-MTU = 1492  2025-05-13T09:00:14.062857+02:00 FortiAuthenticator-BA radiusd[1488]:         NAS-IP-Address = 10.10.1.116  2025-05-13T09:00:14.062861+02:00 FortiAuthenticator-BA radiusd[1488]:         NAS-Identifier = "TEST-SWITCH"  2025-05-13T09:00:14.062863+02:00 FortiAuthenticator-BA radiusd[1488]:         User-Name = "aabbcc"  2025-05-13T09:00:14.062867+02:00 FortiAuthenticator-BA radiusd[1488]:         Service-Type = Call-Check  2025-05-13T09:00:14.062869+02:00 FortiAuthenticator-BA radiusd[1488]:         Framed-Protocol = PPP  2025-05-13T09:00:14.062872+02:00 FortiAuthenticator-BA radiusd[1488]:         NAS-Port = 5  2025-05-13T09:00:14.062874+02:00 FortiAuthenticator-BA radiusd[1488]:         NAS-Port-Type = Ethernet  2025-05-13T09:00:14.062877+02:00 FortiAuthenticator-BA radiusd[1488]:         NAS-Port-Id = "5"  2025-05-13T09:00:14.062879+02:00 FortiAuthenticator-BA radiusd[1488]:         Called-Station-Id = "DD-EE-FF-88-46-fb"  2025-05-13T09:00:14.062882+02:00 FortiAuthenticator-BA radiusd[1488]:         Calling-Station-Id = "AA-BB-CC-a7-ee-62"  2025-05-13T09:00:14.062885+02:00 FortiAuthenticator-BA radiusd[1488]:         Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex"  2025-05-13T09:00:14.062938+02:00 FortiAuthenticator-BA radiusd[1488]:         CHAP-Password = 0xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx  2025-05-13T09:00:14.062943+02:00 FortiAuthenticator-BA radiusd[1488]:         Message-Authenticator = 0x36962cf3c173bfad7aaeaef322671545  2025-05-13T09:00:14.062946+02:00 FortiAuthenticator-BA radiusd[1488]:         MS-RAS-Vendor = 11  2025-05-13T09:00:14.062948+02:00 FortiAuthenticator-BA radiusd[1488]:         HP-Capability-Advert = 0x011a0000000b28  2025-05-13T09:00:14.062951+02:00 FortiAuthenticator-BA radiusd[1488]:         HP-Capability-Advert = 0x011a0000000b2e  2025-05-13T09:00:14.062953+02:00 FortiAuthenticator-BA radiusd[1488]:         HP-Capability-Advert = 0x011a0000000b30  2025-05-13T09:00:14.062955+02:00 FortiAuthenticator-BA radiusd[1488]:         HP-Capability-Advert = 0x011a0000000b3d  2025-05-13T09:00:14.062957+02:00 FortiAuthenticator-BA radiusd[1488]:         HP-Capability-Advert = 0x011a0000000b18  2025-05-13T09:00:14.062960+02:00 FortiAuthenticator-BA radiusd[1488]:         HP-Capability-Advert = 0x011a0000000b19  2025-05-13T09:00:14.062962+02:00 FortiAuthenticator-BA radiusd[1488]:         HP-Capability-Advert = 0x011a0000000b1b  2025-05-13T09:00:14.062964+02:00 FortiAuthenticator-BA radiusd[1488]:         HP-Capability-Advert = 0x0138  2025-05-13T09:00:14.063011+02:00 FortiAuthenticator-BA radiusd[1488]:         HP-Capability-Advert = 0x013a  2025-05-13T09:00:14.063015+02:00 FortiAuthenticator-BA radiusd[1488]:         HP-Capability-Advert = 0x0140  2025-05-13T09:00:14.063018+02:00 FortiAuthenticator-BA radiusd[1488]:         HP-Capability-Advert = 0x0141  2025-05-13T09:00:14.063020+02:00 FortiAuthenticator-BA radiusd[1488]:         HP-Capability-Advert = 0x0151  2025-05-13T09:00:14.063024+02:00 FortiAuthenticator-BA radiusd[1488]:         Event-Timestamp = "May 13 2025 09:00:14 CEST"  2025-05-13T09:00:14.063026+02:00 FortiAuthenticator-BA radiusd[1488]:         CHAP-Challenge = 0x8586df7105c2d596ce8760cee8b50ab5  2025-05-13T09:00:14.063029+02:00 FortiAuthenticator-BA radiusd[1488]: (4767) facauth: ===>NAS IP:10.10.1.116  2025-05-13T09:00:14.063037+02:00 FortiAuthenticator-BA radiusd[1488]: (4767) facauth: ===>Username:aabbcc  2025-05-13T09:00:14.063042+02:00 FortiAuthenticator-BA radiusd[1488]: (4767) facauth: ===>Timestamp:1747119614.61868, age:1ms  2025-05-13T09:00:14.063045+02:00 FortiAuthenticator-BA radiusd[1488]: (4767) facauth: old_authtype: chap (10870718)   2025-05-13T09:00:14.063594+02:00 FortiAuthenticator-BA radiusd[1488]: (4767) facauth: Comparing client IP 10.10.1.116 with authclient BA-TEST (10.10.1.116, 1 IPs)  2025-05-13T09:00:14.063597+02:00 FortiAuthenticator-BA radiusd[1488]: (4767) facauth: ------> matched!   2025-05-13T09:00:14.063706+02:00 FortiAuthenticator-BA radiusd[1488]: (4767) facauth: Found authclient from preloaded authclients list for 10.10.1.116: BA-TEST (10.10.1.116)  2025-05-13T09:00:14.063711+02:00 FortiAuthenticator-BA radiusd[1488]: (4767) facauth: authclient_id:1 auth_type:'mab'  2025-05-13T09:00:14.064647+02:00 FortiAuthenticator-BA radiusd[1488]: (4767) facauth: Found authpolicy 'Switch-MAC-bypass' for client '10.10.1.116'  2025-05-13T09:00:14.065066+02:00 FortiAuthenticator-BA radiusd[1488]: (4767) facauth: Setting 'Auth-Type := CSID' 2025-05-13T09:00:14.065119+02:00 FortiAuthenticator-BA radiusd[1488]: (4767) facauth: Updated auth log 'aabbcc' for attempt from 10.10.1.116: user authentication error: invalid user  2025-05-13T09:00:14.065125+02:00 FortiAuthenticator-BA radiusd[1488]: (4767)     [facauth] = updated 2025-05-13T09:00:14.065132+02:00 FortiAuthenticator-BA radiusd[1488]: Not doing PAP as Auth-Type is already set. 2025-05-13T09:00:14.065136+02:00 FortiAuthenticator-BA radiusd[1488]: (4767)     [pap] = noop 2025-05-13T09:00:14.065141+02:00 FortiAuthenticator-BA radiusd[1488]: (4767)   } # authorize = updated 2025-05-13T09:00:14.065149+02:00 FortiAuthenticator-BA radiusd[1488]: (4767) Found Auth-Type = CSID 2025-05-13T09:00:14.065161+02:00 FortiAuthenticator-BA radiusd[1488]: (4767) # Executing group from file /usr/etc/raddb/sites-enabled/default 2025-05-13T09:00:14.065165+02:00 FortiAuthenticator-BA radiusd[1488]: (4767)   Auth-Type CSID { 2025-05-13T09:00:14.066989+02:00 FortiAuthenticator-BA radiusd[1488]: (4767) facauth: Add Static Radius attribute: attr_id:65 (attr 65, vendor 0) attr_val:'6'  2025-05-13T09:00:14.066995+02:00 FortiAuthenticator-BA radiusd[1488]: (4767) facauth: Add Static Radius attribute: attr_id:64 (attr 64, vendor 0) attr_val:'13'  2025-05-13T09:00:14.066999+02:00 FortiAuthenticator-BA radiusd[1488]: (4767) facauth: Add Static Radius attribute: attr_id:81 (attr 81, vendor 0) attr_val:'199'  2025-05-13T09:00:14.068085+02:00 FortiAuthenticator-BA radiusd[1488]: (4767) facauth: MAC-based authentication OK 2025-05-13T09:00:14.068090+02:00 FortiAuthenticator-BA radiusd[1488]: (4767) facauth: Setting 'Post-Auth-Type := CSID' 2025-05-13T09:00:14.068143+02:00 FortiAuthenticator-BA radiusd[1488]: (4767) facauth: Updated auth log 'B20195042' for attempt from 10.10.1.116: MAC-based authentication successful  2025-05-13T09:00:14.068152+02:00 FortiAuthenticator-BA radiusd[1488]: (4767) facauth: facauth: print reply attributes of request id 39:  2025-05-13T09:00:14.068157+02:00 FortiAuthenticator-BA radiusd[1488]:         Message-Authenticator := 0x00  2025-05-13T09:00:14.068162+02:00 FortiAuthenticator-BA radiusd[1488]:         Tunnel-Medium-Type += IEEE-802  2025-05-13T09:00:14.068168+02:00 FortiAuthenticator-BA radiusd[1488]:         Tunnel-Type += VLAN  2025-05-13T09:00:14.068171+02:00 FortiAuthenticator-BA radiusd[1488]:         Tunnel-Private-Group-Id += "199"  2025-05-13T09:00:14.068175+02:00 FortiAuthenticator-BA radiusd[1488]: (4767)     [facauth] = ok 2025-05-13T09:00:14.068178+02:00 FortiAuthenticator-BA radiusd[1488]: (4767)   } # Auth-Type CSID = ok 2025-05-13T09:00:14.068761+02:00 FortiAuthenticator-BA radiusd[1488]: (4767) Using Post-Auth-Type CSID

 

 

6 replies

Anthony_E
Staff
Anthony_E
Staff
May 16, 2025

Hello,


Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.


Thanks,

Best Regards
    Anthony_E
    Staff
    Anthony_E
    Staff
    May 19, 2025

    Hello,

     

    We are still looking for someone to help you.

    We will come back to you ASAP.


    Thanks,

    Best Regards
      tbarua
      Staff
      tbarua
      Staff
      May 19, 2025

      Hi, 

       

      As per the provided logs , User aabbcc is marked as invalid user. Can you confirm is it a valid user? 

       

      2025-05-13T09:00:14.065119+02:00 FortiAuthenticator-BA radiusd[1488]: (4767) facauth: Updated auth log 'aabbcc' for attempt from 10.10.1.116: user authentication error: invalid user

       

      Successful log: 

      2025-05-13T09:00:14.068143+02:00 FortiAuthenticator-BA radiusd[1488]: (4767) facauth: Updated auth log 'B20195042' for attempt from 10.10.1.116: MAC-based authentication successful

       

      In successful logs user B20195042' got authenticated successfully by MAC-based authentication successful which seems valid user. 

       

      Kind regard,

        tobisfr
        tobisfrAuthor
        Explorer
        May 19, 2025

         

        Sorry, I modified the MAC address in the logs because I didn't want to publish it.
        aabbcc is the Mac address of the mentioned client  B20195042. 

        It only exists under User Management -> MAC Devices.

         

        julien_henry
        julien_henry
        New Member
        July 2, 2025

        Hello,

        It looks more like a bug because this behavior appeared for us after the 6.6.2->6.6.3 update for our customers. Everything continues to work well as before. However, the logs are polluted and exceptions had to be made on the SIEM side.

        Regards,
        Julien

          shikhakolekar
          Staff
          shikhakolekar
          Staff
          July 23, 2025

          Hello, 

           

          This is related to  a known issue 1168347, which is targeted to be fixed in 6.6.5. The authentication is always successful, but log would show a failed result and then a success one, it is only a behavioral change when we look at the log, has no impact on authentication. 

           

          If you have found a solution, please like and accept it to make it easily accessible to others.


          Thanks

            Terms & ConditionsAccessibility statement
            Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!