Skip to main content
Andy_R
Andy_R
New Member
September 23, 2022
Solved

SSL VPN using RADIUS "unknown user"

  • September 23, 2022
  • 1 reply
  • 3523 views

Hello,

 

I am configuring the SSL VPN on a FortiGate 100D running firmware 6.0.5. I have setup RADIUS auth because we are using Duo MFA. When I use the "Test User Credentials" option it's successful. Although, when I try to connect to the VPN, it fails. The logs on the FortiGate say "ssl-login-fail Reason: sslvpn_login_unknown_user".

 

Up until recently, users were using local accounts on the firewall to connect to the VPN. I'm suspecting the FortiGate thinks my user is a local user and isn't finding it. The VPN setup has my new group using RADIUS listed and mapped to a portal, so I'm not sure what I'm doing wrong. Any suggestions?

Best answer by Toshi_Esumi

If you still have doubt the FGT is not sending an auth request to Duo side, you can sniff packet for UDP 1812 with Duo's server IP. If you do it with outgoin interface with option 6, you can convert the capture to a PCAP file that Wireshark can open. Then you can see what the FGT sent and what Duo replied back.

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-import-diagnose-sniffer-packet-data-to/ta-p/191727

1 reply

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
September 23, 2022

I don't think so. As long as you removed the local user from the SSLVPN user group, the FGT wouldn't look for it in local users.

The GUI's user credential test at least with that old version doesn't check actual credential but just check reachability. To test a user credential, you have to use CLI:

diag test authserver radius <server_name> [pap|chap|...] "<user_name>" "<password>"

 

Toshi

Andy_R
Andy_RAuthor
New Member
September 23, 2022

Interesting, because I had that thought and tried testing with an intentionally wrong password and it failed. The test account I'm using only exists in AD. No local account on the fortigate with the same name. I'm leaning towards this being a bug at this point. Will be upgrading the firmware to rule that out at least.

Toshi_Esumi
SuperUser
Toshi_EsumiAnswer
SuperUser
September 23, 2022

If you still have doubt the FGT is not sending an auth request to Duo side, you can sniff packet for UDP 1812 with Duo's server IP. If you do it with outgoin interface with option 6, you can convert the capture to a PCAP file that Wireshark can open. Then you can see what the FGT sent and what Duo replied back.

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-import-diagnose-sniffer-packet-data-to/ta-p/191727

Terms & ConditionsAccessibility statement