Explorer

Question

Fortigate Radius

8 replies
10690 views

Hello Everyone,

I'm trying to set up Radius for Fortigate logins and I'm having an issue. When I run the authentication tests from the GUI, it says its successful, but then when trying to login to the device, I get the message "Authentication failure." Its really quick too as if its looking for a local account. Any help would be appreciated.

Thanks!

Radius

johnathan

Staff

What RADIUS server are you using? The most common cause of that is the RADIUS server not sending back the group information in the Access-Accept.
See this article for NPS: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-define-group-based-authorization/ta-p/198062

Never trust a computer you can't throw out a window.

Toshi_Esumi

SuperUser

You used "Test User Credentials" button, instead of "Test Connectivity", from the GUI when you tested it, right? Then the credential (username/password) is fine. Then probably your group config and/or admin config might have a problem.
Show us both in CLI or GUI. In CLI, those are under "config user group" and "config system admin".

Toshi

Aiko1979Author

Explorer

Correct, "Test User Credential" works in the GUI.

Here you are:

Test-FG40-1 # config user group

Test-FG40-1 (group) # sh
config user group
edit "SSO_Guest_Users"
next
edit "Guest-group"
set member "guest"
next
edit "NPS_FGT_Admins"
set member "RADIUS"
next
end

Test-FG40-1 # conf sys admin
Test-FG40-1 (admin) # sh
config system admin
edit "admin"
set trusthost1 10.0.0.0 255.0.0.0
set trusthost2 172.16.0.0 255.240.0.0
set trusthost3 192.168.0.0 255.255.0.0
set accprofile "super_admin"
set vdom "root"
set password ENC <password>
next
end

Aiko1979Author

Explorer

I just figured it out after I replied. I needed to add the admin account for RADIUS. I appreciate your help!

FortiArt

Staff

Are you referencing specific Radius group or all groups. If referencing specific group you need to configure VSA on radius to send the group name to fortigate. If this not the case and you referencing all group, then try the following CLI command to give you a clue about what's going on as in first article:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Radius-authentication-troubleshooting/ta-p/196192?externalID=FD46949

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-define-group-based-authorization/ta-p/198062?externalID=FD51328

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Fortinet-RADIUS-vendor-specific-attributes-VSAs/ta-p/191592

https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/710485/restricting-radius-user-groups-to-match-selective-users-on-the-radius-server

Thank you

WesleyEli

New Member

When I try to log in to the Fortigate device, I get an "Authentication failure" message almost instantly, as if it’s bypassing the RADIUS server and checking for a local account instead.

Toshi_Esumi

SuperUser

You can't remote-authenticate a username, which exists in local admin config such as "admin". FGT looks up local admins first, before contacting the radius server based on "set wildcard enable" I showed in the radius admin user config.
If you want to confirm, you can always sniff packet like below:
diag sniffer packet any "port 1812" 4 0 l
to see if the auth request packets are going out.

Toshi

Sign up

Login with SSO

Login to the community

Login with SSO