user's disconnect request Not working

Question

hello every body

I configured freeradius with fortigate and my sql database , every thing go fine else that when user exceeded his internet limit ,the connection not cutting automatically

I searched about this in the internet and foud that I must develop batch file which must run every unit of time minutes for example and this batch file will go to radacct table to find the ammount of AcctInputOctets and AcctOutoutput octets to decide if user exceeded his limit or not

every thing go right but when I send disconnect message to fortigate it replay with this message

>>echo "User-Name=zaib"| radclient -x 192.168.3.1 disconnect muh

Sending Disconnect-Request of id 7 to 192.168.3.1 port 3799 Acct-Session-Id = "D91FE8E51802097" User-Name = "zaib" NAS-IP-Address = 192.168.3.1 rad_recv: Disconnect-NAK packet from host 192.168.3.1 port 3799, id=7, length=50 Error-Cause = Unsupported-Attribute Event-Timestamp = "Jul 3 2017 14:56:48 +03" Message-Authenticator = 0x3543193d85fbc063ee2d312f68c54ece

I don't know what is unsuppoted attribute mean and which attribute is unsupported

I searched alote about this problem without result

I sure Iwill get solution in this forum

thank you very much

xsilver_FTNT · Answer

Hi starking9b,

I just guess that user was authenticated via captive portal and probably some WiFi, so WPA-Enterprise + UserGroup on FortiGate (FGT).

So you have to send USER_NAME and FRAMED_IP_ADDRESS together in CoA disconnect.

Avoid Message-Authenticator as if not computed correctly it can produce this error as well.

Diag debug app radius on FGT to see more. Because the same error without any details could be triggered by many things including incorrect shared secret, no session context found (code 503) and more.

If you succeed then Disconnect-ACK should be seen from FGT, otherwise Disconnect-NAK is sent. Packet capture the traffic.

Strip down the disconnect request to just mentioned username and framed ip address as if any other unrecognized attribute is seen by FortiOS it will reply Disconnect-NAK (code 401) unsupported attribute.

Use FortiOS 5.4.1 and later to avoid CoA handling issues we have fixed.

Best regards,

Tomas

Sign up

Login with SSO

Login to the community

Login with SSO