FortiGate and Fortiap with Radius authentication

It looks like there is some issue with the DHCP server configured for this VPN . Doble check the configuration and DHCP scope

On the FortiGate what IP do you see for this user? Same APIPA?
You can also run packet capture to see if the DHCP negotiation process. 

A couple of questions to help narrow it down:

Are you using a bridge or tunnel SSID?

- If bridged did you assign a default vlan?

- If Tunneled do you have the DHCP server enabled on that ssid interface?

Are you trying to send back any vlans in the radius response or just an access-accept?

@dbu 
Hi its on the same scope and in the DHCP  I see  the domain and the user and a legitimate IP for exmaple 10.40.40.2

I tried to see dhcp negotiation by running this commands

diag debug reset
diag debug application dhcpc -1
diag debug enable

and it didn't show any results..

@distillednetwork 

I  used tunnel with DHCP server enabled

And i think its just access accept.. if the user is in a group "WIFI" so it can get access to the internet

I

@dbu  @jiahoong112 

I ran the commands but it doesn't show anything

I see in the DHCP that the mac address got an IP with username and password

if you look at the scope are there any DHCP options that are set?  

config system dhcp server

I would also run a wireshark capture on the client and see if you get the DHCP OFFER to the client.  

@RandomTechGuy 

Release the IP for the end device and then run the packet sniffer for DHCP:
diag sniffer packet any "port 67 or port 68" 4 0 l

Also run wireshark on end device at the same time

Check if the DORA process completes on both sides. 

When Fortigates sends offer, it will put the IP in DHCP lease even if DORA has not completed. So in that case you would see IP Assigned on fortigate but no IP on end device.  

In WiFi usually the DHCP is usually wrongfully blamed :) In my experience that is not always the case. 

You can check if the authentication is successful and the VLAN is returned by the RADIUS server:

or from CLI

GW # diagnose wireless-controller wlac -c sta
-------------------------------STA 1----------------------------
STA mac : 88:46...
live : 96 (ts=17605)
authed : yes
wtp : 0-10.5.32.54:25246
rId : 1
aId : 1
wId : 1
bssid : 70:4c:a5:...
cap : 0111
VLAN tag : 01ff (511)
ACL deny cnt : 0
802.11kvr :
Os Info : Android13

Since you are using an old AP to avoid any compatibility issue between the AP and the client I would suggest to temporarily change the SSID configuration to Personal and if everything works fine including DHCP and access you can revert it to Enterprise.

@ebilcari 

I changed it to WPA 2 Personal and i was able to connect... I'm really lost

BTW i created a new lab for this and now in the fortigate itself i dont see that the user received ip

from dhcp 

here are my configurations

Hi @ebilcari 

i ran the logs.. these are the Results 

hi @ebilcari 
It's important to know that yesterday before I ran the diagnose on the FortiGate

I turned on the FortiGate + server + FortiAp (The whole equipment is for lab so its not on when I'm not using) so I don't think that running this command will do anything.

Is it possible that the AP is having problems ?