Skip to main content
lohelle
lohelle
New Member
June 24, 2012
Question

Problem authenticating with radius on 100D

  • June 24, 2012
  • 6 replies
  • 6527 views
I' m having problem authenticating my SSL-VPN against radius. I have a Fortigate 100D, v4.0,build0535,120511 (MR3 Patch 7) I have a radius server called " duosec" with primary server IP 10.130.1.2 and key " xxxxxxxx" (the key is 8 chars) Authentication scheme on " use Default.." , but have tried all VPN login does not work. In the log I see the following Action: ssl-login-fail Reason: no_matching_policy The strange thing is when I run diag from CLI. diag test authserver radius-direct 10.130.1.2 -1 xxxxxxxx lohelle password Result: 0: OK As you see this is working. But when I try this: diag test authserver radius duosec pap lohelle password (also tried chap, mschap and mschap2) Result: authenticate ' lohelle' against ' pap' failed, assigned_rad_session_id=48824321 session_timeout=0 secs! Is this a bug? I do not understand why radius-direct works, but not " radius definedserver"

    6 replies

    Matthijs
    Matthijs
    New Member
    June 24, 2012
    What do you see in the radius server logs? Are you sure you need pap to authenticate? Can you paste the output of the following command (on the cli) 
      config user radius  show
    lohelle
    lohelleAuthor
    New Member
    June 24, 2012
    I have tried all the auth types (chap, pap, mschap and mschap2) Output: config user radius edit " duosec" set secret ENC HT3gOVPEeHEYSqCvfFnsFb7sm0EWamMyWeSzJx1pPqhaBBJqyL6L7fbBMAwMyK7V8ajmlKJqtokfdAup4JAAvxAYXvxs4HkZATT7FLfIvR9OGoCV set server " 10.130.1.2" next end Actually, when I check the radius log I see that the user is rejected even if the response is 0: OK (Same message as when trying the other diag command) from log: Login attempt for username u' lohelle' Improperly-formatted password: Invalid Password Returning response code 3: AccessReject Sending response
    lohelle
    lohelleAuthor
    New Member
    June 24, 2012
    I have tried changing to a password with just letters, and tried with reversible password encryption for the user account. I use Duo Security Auth Proxy as radius-server, but I also tried MS IAS.
    Matthijs
    Matthijs
    New Member
    June 24, 2012
    Did you try changing the shared secret? The error seems to be clear but can also be about the secret. It seems you are using freeradius. How did you configure it? Are you sure the IP address used by the fortigate to connect to the radius server is the same as you have allowed in the freeeradius server?
    lohelle
    lohelleAuthor
    New Member
    June 24, 2012
    Tried a different secret now. Will try some other client than Fortigate and check the logs then.
    lohelle
    lohelleAuthor
    New Member
    June 24, 2012
    ok. Found the problem. The Duo security proxy expected password,sms or password,push , and then I get a push request to approve the login. I need to adjust the timeout btw, because I do not have enough time to respond before the login is rejected.
    Terms & ConditionsAccessibility statement