Skip to main content
Jond
Jond
New Member
March 26, 2018
Question

NPS not forwarding Class attribute to FG

  • March 26, 2018
  • 1 reply
  • 3338 views

I've an odd problem.

 

I've set up NPS to forward to the Fortigate, including adding the 'Class' attribute to tie in with an RSSO group.

 

I have two wireless controllers, one a Juniper/Trapeze, the other an Aruba.  Bizarrely the packets arrive on the FG with a correctly set Class attribute from NPS for authentications originating on the Aruba, but not the Juniper/Trapeze.  Both of them go through the same network policies on NPS.

 

Anyone have any ideas?

 

Thanks :)

    1 reply

    xsilver_FTNT
    Staff
    xsilver_FTNT
    Staff
    March 26, 2018

    Hi,

    in short .. 

    - two WLCs talking to the same NPS RADIUS server

    - that NPS is sending RADIUS Accounting to FGT

    - and if the same user login via one WLC (Aruba) then NPS sends Class in Accounting Req type Start or Interim-Update

    - but if the same user login via second WLC (Juniper) then NPS do not sand Class AVP ?

    - the missing Class is confirmed via sniffer, it's not just that Acct start and RSSO resulted in user without group membership, the AVP is trully not in the packet sent on NPS and received (not lost on the way) on FGT

     

    If above is correct then it seems to me as the most probable that NPS actually do NOT has the same policy for both.

    Double check and make sure the policies are the same, the user is the same, that there is surely the source/config where Class can be inherited (not sure if you do so per policy or per user group).

     

     

    Kind regards,

    Tomas

    Terms & ConditionsAccessibility statement