Skip to main content
Aiko1979
Aiko1979
Explorer
August 14, 2024
Question

Fortigate Radius

  • August 14, 2024
  • 4 replies
  • 10619 views

Hello Everyone, 

 

I'm trying to set up Radius for Fortigate logins and I'm having an issue. When I run the authentication tests from the GUI, it says its successful, but then when trying to login to the device, I get the message "Authentication failure." Its really quick too as if its looking for a local account. Any help would be appreciated. 

 

Thanks!

4 replies

johnathan
Staff
johnathan
Staff
August 14, 2024

What RADIUS server are you using? The most common cause of that is the RADIUS server not sending back the group information in the Access-Accept.
See this article for NPS: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-define-group-based-authorization/ta-p/198062

Never trust a computer you can't throw out a window.
    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    August 14, 2024

    You used "Test User Credentials" button, instead of "Test Connectivity", from the GUI when you tested it, right? Then the credential (username/password) is fine. Then probably your group config and/or admin config might have a problem.
    Show us both in CLI or GUI. In CLI, those are under "config user group" and "config system admin".

    Toshi

      Aiko1979
      Aiko1979Author
      Explorer
      August 14, 2024

      Correct, "Test User Credential" works in the GUI. 

       

       

      Here you are:

      Test-FG40-1 # config user group

      Test-FG40-1 (group) # sh
      config user group
      edit "SSO_Guest_Users"
      next
      edit "Guest-group"
      set member "guest"
      next
      edit "NPS_FGT_Admins"
      set member "RADIUS"
      next
      end

       

      Test-FG40-1 # conf sys admin
      Test-FG40-1 (admin) # sh
      config system admin
      edit "admin"
      set trusthost1 10.0.0.0 255.0.0.0
      set trusthost2 172.16.0.0 255.240.0.0
      set trusthost3 192.168.0.0 255.255.0.0
      set accprofile "super_admin"
      set vdom "root"
      set password ENC <password>
      next
      end

       

        Aiko1979
        Aiko1979Author
        Explorer
        August 14, 2024

        I just figured it out after I replied. I needed to add the admin account for RADIUS. I appreciate your help!

          FortiArt
          Staff
          FortiArt
          Staff
          August 14, 2024

          Are you referencing specific Radius group or all groups. If referencing specific group you need to configure VSA on radius to send the group name to fortigate. If this not the case and you referencing all group, then try the following CLI command to give you a clue about what's going on as in first article:

           

          https://community.fortinet.com/t5/FortiGate/Technical-Tip-Radius-authentication-troubleshooting/ta-p/196192?externalID=FD46949

          https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-define-group-based-authorization/ta-p/198062?externalID=FD51328

           

          https://community.fortinet.com/t5/FortiGate/Technical-Tip-Fortinet-RADIUS-vendor-specific-attributes-VSAs/ta-p/191592

           

          https://docs.fortinet.com/document/fortigate/7.4.3/administration-guide/710485/restricting-radius-user-groups-to-match-selective-users-on-the-radius-server

           

          Thank you

            WesleyEli
            WesleyEli
            New Member
            August 29, 2024

            When I try to log in to the Fortigate device, I get an "Authentication failure" message almost instantly, as if it’s bypassing the RADIUS server and checking for a local account instead.

            Toshi_Esumi
            SuperUser
            Toshi_Esumi
            SuperUser
            September 9, 2024

            You can't remote-authenticate a username, which exists in local admin config such as "admin". FGT looks up local admins first, before contacting the radius server based on "set wildcard enable" I showed in the radius admin user config.
            If you want to confirm, you can always sniff packet like below:
             diag sniffer packet any "port 1812" 4 0 l
            to see if the auth request packets are going out.

            Toshi

              Terms & ConditionsAccessibility statement