Skip to main content
stevenpwest
stevenpwest
New Member
September 19, 2023
Question

Radius Auth issus on FortiGate 7.4.1

  • September 19, 2023
  • 8 replies
  • 3716 views

Hi

Since upgrading to 7.4.1 none of the 801.x Radius Wifi SSIDS will authenticate.

We have an open support case, but not finding anything specific.

Any one noticed similar behaviour?

8 replies

Mrinmoy
Staff
Mrinmoy
Staff
September 19, 2023

Can you please share the case ID?

stevenpwest
stevenpwestAuthor
New Member
September 19, 2023

Sure 8770664

johnathan
Staff
johnathan
Staff
September 19, 2023

The best way to find out why a wireless client can't connect via RADIUS is by running the debug in this article: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Debugging-a-wireless-client-connection-issue/ta-p/196660

It will tell you whether or not an attempt is made to the RADIUS server, and what the RADIUS server came back to you with.

Never trust a computer you can't throw out a window.
stevenpwest
stevenpwestAuthor
New Member
September 19, 2023

Hi Running the debug scripts shows a good back and fourth between client and FW

61219.513 ac:74:b1:6a:b0:f8 <eh> RADIUS message (type=0) ==> RADIUS Server code=1 (Access-Request) id=181 len=343
61219.513 ac:74:b1:6a:b0:f8 <eh> RADIUS message (type=0) <== RADIUS Server code=11 (Access-Challenge) id=181 len=1490

 

But client never connects

 

61232.748 ac:74:b1:6a:b0:f8 <eh> ***WPA_PTK ac:74:b1:6a:b0:f8 DISCONNECTED***
12210.748 245 ac:74:b1:6a:b0:f8 <cc> STA_CFG_REQ(125) sta ac:74:b1:6a:b0:f8 del ==> ws (0-10.60.206.40:5246) rId 1 wId 0
12210.749 245 ac:74:b1:6a:b0:f8 <cc> STA del ac:74:b1:6a:b0:f8 vap Syd-VAP ws (0-10.60.206.40:5246) rId 1 wId 0 00:0c:e6:b3:83:d1 sec WPA2 RADIUS action idle_timeout
reason 508
12210.749 245 ac:74:b1:6a:b0:f8 cwAcStaRbtDel: D2C/C2C_STA_DEL remove sta ac:74:b1:6a:b0:f8 10.60.206.40/1/0/3 from staRbt
12210.749 245 ac:74:b1:6a:b0:f8 <dc> STA chg ac:74:b1:6a:b0:f8 vap Syd-VAP ws (0-10.60.206.40:5246) rId 1 wId 0 bssid 00:0c:e6:b3:83:d1 NON-AUTH
12210.749 245 ac:74:b1:6a:b0:f8 <cc> STA chg no key ac:74:b1:6a:b0:f8 vap Syd-VAP ws (0-10.60.206.40:5246) rId 1 wId 0 00:0c:e6:b3:83:d1 sec WPA2 RADIUS user host/SW
10S06301.cbp.local group NULL
12210.749 245 ac:74:b1:6a:b0:f8 <dc> STA chg ac:74:b1:6a:b0:f8 vap Syd-VAP ws (0-10.60.206.40:5246) rId 1 wId 0 bssid 00:0c:e6:b3:83:d1 NON-AUTH
12210.749 245 ac:74:b1:6a:b0:f8 <cc> STA chg no key ac:74:b1:6a:b0:f8 vap Syd-VAP ws (0-10.60.206.40:5246) rId 1 wId 0 00:0c:e6:b3:83:d1 sec WPA2 RADIUS user host/SW
10S06301.cbp.local group NULL
12210.751 245 ac:74:b1:6a:b0:f8 <cc> STA_CFG_RESP(125) ac:74:b1:6a:b0:f8 <== ws (0-10.60.206.40:5246) rc 0 (Success)

 

No IP address is assigned to client and 801.x auth disassocation is recorded in logs

 

johnathan
Staff
johnathan
Staff
September 21, 2023

Any logs on the RADIUS server? It's asking the client for additional information for some reason.

Never trust a computer you can't throw out a window.
pmeet
Staff
pmeet
Staff
September 19, 2023

Hello Steve ,

Please refer: https://community.fortinet.com/t5/FortiGate/Technical-Tip-EAP-Proxy-consuming-high-CPU-after-upgrade-to/ta-p/262786 

 

This was a known issue with the wifi certificate getting updated, can you try to reboot your firewall if you still sees eap_proxy crash in the crash log,

You can also test by configuring one SSID with simple pre shared key authentication to rule out that its only a RADIUS authentication issue,

stevenpwest
stevenpwestAuthor
New Member
September 19, 2023

None of the commands show any evidence of a certificate issue. EAP_Proxy is runnig, but not crashing.  WAP2 Personal SSID works fine.

Terms & ConditionsAccessibility statement