Radius Authentication - unwanted machine authentication

Forum|Forum|8 years ago
November 27, 2017
4 replies
6468 views

We use Forti Authenticator as a radius server for our wireless authentication. I did give the realm and in the query elements under Remote auth. servers -> LDAP as user authentication attributes. For some reason, the authenticator is also checking for machine authentication and getting failed. This machine authentication logs are being piled up increasing the memory usage to over 95% which is slowing down the authenticator performance.

We had to reboot the authenticator couple of times in 2 weeks span just because of the over memory utilization. Can someone help me figure the issue and not allow the authenticator to try checking for machine authentication?

Best answer by Carl_Windsor_FTNT

Handy hint when it comes to sniffing RADIUS. You can put your shared secret into Wireshark and it will use this to decode the packets:

xsilver_FTNT

Staff

Hi,

it seems to me that you might do 802.1x EAP authentication and the clients' (workstation) supplicant sends machine auth info (AFAIK Windows does this by default).

Those auth requests are probably through chosen realm sent to outer auth server like AD/DC, probably via another RADIUS or LDAP.

Those requests probably get stalled and unresponded by that 3rd party server, causing FortiAuthenticator (FAC) to wait for response for too long and keep auth sessions open, stacking them up.

Check the packet capture and logs on FAC to confirm your setup and behavior.

If above is the case I would suggest to do following on FAC:

---

(If remote realm is another RADIUS)

- check FAC > GUI > Authentication > General > User Account Policies > "Discard stale RADIUS authentication requests"

(if remote realm is LDAP)

- default is 60 which is way too long (changed in newer FAC), so set to some 5-10 sec following .. FAC > GUI > Authentication > Remote Auth. Servers > General > "LDAP Server Response Timeout:"

Best regards,

Tomas

alladasAuthor

New Member

Thank you for your response. The issue is that FAC should not try to authenticate the machine authentication in any way. As per your suggestion, the response time only reduces the time period for open authentication sessions but do not get rid of the issue.

correct me if I'm wrong.

xsilver_FTNT

Staff

If you do 802.1x auth, then it is most probably the workstation who is telling to FAC, "Hey my machine is XYZ and I'd like to authenticate as such.", and FAC is just passing that auth info to back-end DC/LDAP. For that you probably has "Windows Active Directory Domain Authentication" in LDAP config.

That seems to me as most probable origin of the machine auth done/tried.

But sniff the traffic of RADIUS Access-Request packets to see on your own.

Second, timers, yes, they do not prevent machine authentication at all.

But if your NPS/DC/LDAP is set to ignore those request instead of reject those clearly, then FAC has no way how to tell if auth is gonna pass or fail. So FAC is forced to wait.

By timers you just reduce the amount of 'patience' the FAC will have with LDAP while waiting for response. As result FAC will terminate the queries and auth attempts sooner. Preventing the requests from stockpiling too much.

Sign up

Login with SSO

Login to the community

Login with SSO