FSSO user Wifi Radius WPA2 Enterprise

Do you have any on-premise read only domain controllers? If not, do you have domain services enabled with your AzureAD. If you do, fortiGate can talk via LDAP to either of those services to perform WPA-Enterprise Auth for your wireless clients (using username and password) https://mobdro.bio/ .

"Do you have any on-premise read only domain controllers?" for what ?

" If not, do you have domain services enabled with your AzureAD"  no, none of that.
we have everything on-premis. My Fortigate talk via Radius to authenticat.

I have also a FSSO Agent install on AD domain to perform a FSSO via LAN, but the IPV6 address there are only for the Wifi groups

Hi Fabio

The displayed IPv6 addresses seems random, so it is unlikely that they were assigned by any DHCP server.

In case you don't need IPv6 in your firewall then I think if you disable it you should not see such addresses anymore.

Do you think it is better to disable it globally or on the vap interface of the SSID?

If you don't need it you may try both.

I tried this command , but the default value were already disable..

To disable IPv6 in the CLI, run the following commands:

config sys global

set gui-ipv6 disable

end

To disable IPv6 an on interface level using the CLI:

config sys interface

edit <name_of_the_interface>

config ipv6

unset ip6-address <IPv6 prefix>
unset ip6-allowaccess <>

end

Hi Fabio,

as you stated you have, and as it seems from screenshot, FSSO Collector Agent feeding FortiGate with users. Then I would check a Logged on Users on collector GUI.
Because:
- windows OS is trying to "register" assigned, or set, IP addresses from interfaces into DNS

- and collector agent does DNS query to discover ALL IPs of the host PC where user logged in from

Therefore it seems to me possible that user logged into workstation. Which registered IPv6 into DNS. Then Collector found it and added to a list of all IPs where we can expect a user from. Simply as additional FSSO user list record. And fed those to your FortiGate.

Hello,
the list of users with ipv6 only happens with WPA2 Enterprise wifi and not for example with others that I manage in WPA2/3 or Captive Portal. There must be something with the Windows AD and his NPS ( Radius module ) . I'll also put you the screenshot with the Collector Agent users installed on the Domain Controller but here you don't see users connected in IPV6.
I'm going to see if any configuration of the NPS that runs the RADIUS module has qualvhe problem with hosts that have IPV6 interface enabled.
Then as you see with the user in a few seconds it takes several IP addresses in IPV6.. and this user has an iPhone not a Windows laptop.

Dear Fabio,

I'm not sure if this has been suggested before, but based on the screenshot snippets, the IPv6 information does NOT come from FSSO - the login source shows as 'WiFi Single Sign On', not 'FSSO'.

Can you run this command in CLI?

'dia firewall auth list'

That should give you a better idea of the authentication source; I'm guessing FortiGate is passively picking up on WPA2 enterprise auth in some way, and generates logins from that.

Cheers,

Debbie