Fortigate RADIUS with Microsoft NAS

Question

Hi,

I’m having a lot of trouble getting ourFortiGate firewalls (100Fs / v7.2.10 build1706) to connect to our Microsoft NAS RADIUS server (Windows Server 2022).

In NAS there is a tick box that says “Access-Request messages must contain the Message-Authenticator attribute”, my research shows that given version of the Forti software we are running, this should be ticked, however with this ticked Forti reports “Unable to reach RADIUS server” and Windows Event Viewer shows:

“An Access-Request message was received from RADIUS client 10.10.100.1 without a Message-Authenticator attribute when a Message-Authenticator attribute is required. Verify the configuration of the RADIUS client in the Network Policy Server snap-in (the "Client must always send the Message-Authenticator attribute in the request" checkbox) and the configuration of the network access server.”

If I untick it then Forti reports invalid secret (even though it’s been triple checked, reset, and checked some more) and event viewer shows

“An Access-Request message was received from RADIUS client 10.10.100.1 with a Message-Authenticator attribute that is not valid.”

If my own laptop as a client in NAS an use something like radlogin, it communicated with server ok so it seems to be an issue specific to Forti.

Thanks

AEK · Answer

Hi DaveAre you hitting this known issue?1075627On the User & Authentication > RADIUS Servers page, the Test Connectivity and Test User Credentials buttons may incorrectly return a Can't contact RADIUS server error message when testing against a RADIUS server that requires the message-authentication attribute in the access request from the FortiGate.This is a GUI display issue as the actual RADIUS connection does send the message-authentication attribute.Workaround: confirm if the connection to RADIUS server using the CLI:diagnose test authserver radius

Sign up

Login with SSO

Login to the community

Login with SSO