Skip to main content
kevin001
kevin001
New Member
September 29, 2024
Question

Radius and syslog fails

  • September 29, 2024
  • 3 replies
  • 1718 views

Hai my client uses a separate interface for mgmt 

Syslog, radius servers are behind another port on the firewall.

the  source ip and interface ip mentioned is the mgmt interface and ip and its required for them,

But no syslog is being send. also radius connectivity fails.

There is a policy that allows traffic from management interface to the server port allowing syslog and radius.

 

3 replies

rosatechnocrat
rosatechnocrat
Explorer III
September 29, 2024

This is an local-out traffic, and does not pass via normal Firewall policy. It uses configured local in-traffic policies. 

 

you need to enable ha-direct if the firewall is in a HA group. Check more details below. 

 

config system ha
set ha-direct enable
end
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Sending-messages-logs-SNMP-RADIUS-directly-from/ta-p/197972
 
 
Subscribe "ROSA Technocrat" on Youtube for Fortinet Videos and Troubleshooting https://www.youtube.com/@rosatechnocrat
    kevin001
    kevin001Author
    New Member
    September 29, 2024

    Thanks for the reply,the firewalls are in ha and dedicated mgmt is not selected , will this suggested command above is applicable



    set hbdev "ha" 0 "port16" 0 
    set session-pickup enable
    set override disable
    set priority 255
    set group-name ....

     

    Shashwati
    Staff
    Shashwati
    Staff
    September 29, 2024

    Hello

    To get more information regarding Radius fails, use the following CLI commands:

     

    diagnose debug enable
    diagnose debug application fnbamd 255

     

    To stop this debug type:

     

    diagnose debug application fnbamd 0

     

    https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-RADIUS-authentication-troubleshooting/ta-p/196192

      mpeddalla
      Staff
      mpeddalla
      Staff
      September 29, 2024

      Hello  @kevin001 ,

       

      Thank you for contacting the Fortinet Forum portal.

      Can you confirm before this behavior are there any firmware upgrades ?

      what is the current firmware on the FortiGate device?

      As mentioned by @rosatechnocrat the traffic for syslog is self-generated it doesn't fully relay on the firewall policy itself.

      Please verify the configuration for Syslog :

      https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-syslog-communication-for-HA-setup/ta-p/211546

      https://community.fortinet.com/t5/FortiGate/Technical-Tip-Override-HA-member-syslog-and-FortiAnalyzer-access/ta-p/197588

       

       

      Best regards,

      Manasa.

       

      If you feel the above steps helped resolve the issue, mark the reply as solved so that other customers can get it easily while searching for similar scenarios.

        kevin001
        kevin001Author
        New Member
        September 30, 2024

        Dear Manasa

        This is a new setup with two FortiGate firewalls in HA mode, Dedicated for management is not configured in HA. One interface is separately allocated for management with ip.

        Syslog and ISE are connected to servers in port three, and the management ip is on port 1.

        The firmware version is 7.2.9

        We find while enabling syslog, it uses the interface ip facing Syslog server as the source

        also for ISE source ip is the interface facing the server.

        We need to check the possibility of the firewall using port 1 management ip as a source for ISE and syslog.

        Also, I request another piece of advice regarding FSSO: if a user-based policy is also required instead of groups in FSSO, what kind of agent/collector setup is advised, as collector-only setup helps with group-based policy only it seems.

        Thank you

         

         

        Terms & ConditionsAccessibility statement