Skip to main content
RodrigoAndrade
RodrigoAndrade
New Member
July 24, 2023
Question

FortiAuthenticator RSSO with 802.1x and FortiGate

  • July 24, 2023
  • 1 reply
  • 2676 views

Regards,

I'm trying to create user authentication using the wired network. At the moment, I can get a person to connect to my switch and receive a box to authenticate themselves, and depending on their user group, they will enter VLAN X or VLAN Y. This is working.

My major issue is passing this information from FortiAuthenticator to FortiGate. Does anyone have any suggestions? I tried to do it through the Radius Accounting Proxy, but since I can't use the FAC as the source, I'm not succeeding (I'm trying using the Switch IP as the Source, and enabling accounting proxy at the switch, and FGT as the destination to my accounting proxy destination)

When I sniff on FortiGate at port 1813, I don't see anything besides the Switch sending the accounting to the FAC, so my problem is between FAC and FGT.

1 reply

Markus_M
Staff & Editor
Markus_M
Staff & Editor
July 25, 2023

Hi Rodrigo,

 

if you have a FortiGate then I would suggest using RSSO on FortiAuthenticator and FSSO on the FortiGate. The FortiAuthenticator can "translate" RSSO to FSSO. It reads RSSO with the respective values to create user and IP info and forwards this to FortiGate via regular FSSO.

https://community.fortinet.com/t5/FortiAuthenticator/Solution-Guide-Fortinet-Solutions-RSSO-RADIUS-Single-Sign-On/ta-p/195358

 

Best regards,

 

Markus

    RodrigoAndrade
    RodrigoAndradeAuthor
    New Member
    July 26, 2023

    Hello Markus,

    Thanks for taking your time to reply!

    I've seen this before, but in this case, it's using another Radius Server to authenticate the user and then, the FAC can accouting proxy this information by setting the Radius Server IP as the Proxy Source. In my case, I can't have this Radius Server, because the user authentication it's already be done by the FortiAuthenticator.

    Markus_M
    Staff & Editor
    Markus_M
    Staff & Editor
    July 27, 2023

    Hi Rodrigo,

     

    Sorry I don't follow. Are you using FortiAuthenticator or another server for authentication?

    In case of another server, you can send accounting to the FAC and FortiAuthenticator can do this as FSSO.

    In case of FAC you have to see whether the RADIUS client can do likewise and send accounting to FortiAuthenticator for FSSO. FAC itself does not do accounting to itself. It can do a dirty trick and send syslog messages to 127.0.0.1 and evaluate these as FSSO though.

     

    Best regards,

     

    Markus

     

    Terms & ConditionsAccessibility statement