IPv6 users not authenticated by RSSO and FSSO

Question

Hi

We have 2 Fortigate 300D running FortiOS 5.4.7 in a HA A-A cluster.

Our users are authenticated to our Fortigates by 2 ways: 1) FSSO using the Active Directory collector agent for domain joined machines, and 2) RSSO using Radius Accounting from our wireless (Ubiquiti) to Microsoft NPS Radius for non-domain joined BYOD devices such as iPads.

Our users show as authenticated with IPv4 sessions (user to IP address) as expected for both authentication types. However, we do not see any authenticated users with IPv6 addresses. When users access the internet using an IPv6 address, they get our unauthenticated user policy.

I'm not sure what I need to change to get both the IPv4 and IPv6 authentication for every user. Does Fortigate support dual-stack for user auth in this scenario? Am I missing something?

Shane

xsilver_FTNT · Answer

Hi Shane,

there is no GA release supporting IPv6 in FSSO as of now.

See "FSSO does not currently support IPv6." in FortiOS Release Notes page 14 'Fortinet Single Sign-On' section in integration support part.

https://docs.fortinet.com/uploaded/files/4088/fortios-v5.6.3-release-notes.pdf

There is IPv6 support in RADIUS Accounting (RSSO) on FortiOS.

If you send Framed-IPv6-Address then FortiGate will process it.

Example:

----------

# sent data via radclient (Freradius-utils)

root@SRV-DEB-1:~# echo "Acct-Status-Type = Start, User-Name = JohnDoe , Class = ClassProfile , Framed-IPv6-Address = 2001:db8:0:69a1::1" | radclient -4 -c 1 -n 1 -x 192.168.32.251:1813 acct fortinet Sending Accounting-Request of id 19 to 192.168.32.251 port 1813 Acct-Status-Type = Start User-Name = "JohnDoe" Class = 0x436c61737350726f66696c65 Framed-IPv6-Address = 2001:db8:0:69a1::1

# result in debug app radiusd -1

FGVM_251 # Received radius accounting eventvd 0:root Add/Update auth logon for IP 2001:db8:0:69a1::1 for user (null) DB 0 insert [ep='n/a' pg='ClassProfile' ip='2001:db8:0:69a1::1'] success

# result in DB

FGVM_251 # diagnose test application radiusd 33 RADIUS server database [vd root]: "index","start time","time left","ip","endpoint","block status","log status","profile group","ref count","use default profile" 1,1516088594,07:59:37,"2001:db8:0:69a1::1","","n/a","n/a","<default profile>",0,Yes Best regards,

Tomas

Sign up

Login with SSO

Login to the community

Login with SSO