Wireless authentication fail - Fortiauthenticator + OpenLDAP

Hi Mcosta2587,

Is it possible, could you share LDAP configuration and radius policy on Fortiauthenticator?

I think, you should use LDAPS and domain authentication on Fortiauthenticator.

BR.

Have set this up. There are few way to do it. NAS IP is one way to differentiate between WiFi users and vpn users. The method I used was to configure two radius server profiles on the fortigate and then set the source-ip differently so the requests came from different IPs https://mobdro.bio/ .

Hey mcosta,

there are two things you need to take into account:

1. RADIUS policies for Wifi vs SSLVPN

- FortiAuthenticator has RADIUS policies, and selects a matching one based on RADIUS client (your FortiGate) IP

- if you have two policies (one for SSLVPN authentication, one for Wifi) it is likely only the top policy is matched

-> as quenis6 mentioned, FortiAuthenticator needs some way to distinguish between authentication requests for Wifi and for VPN

-> having two RADIUS server profiles on FortiGate, to set separate source IPs, and thus match into different RADIUS clients on FortiAuthenticator, is an option

-> another method I like to use is to have two RADIUS policies in FortiAuthenticator, the top one for SSLVPN and with a required RADIUS attribute: Connect-Info=SSL (with 'allow substring match' toggled on), and the second RADIUS policy below it with no filter (and having EAP methods enabled)

--> all SSLVPN authentication attempts will hit the first policy; anything NOT SSLVPN will fall through to the second policy

2. PAP vs CHAP vs MS-CHAPv2

- In your setup (involving OpenLDAP), FortiAuthenticator will only be able to authenticate users if it gets the user password in cleartext

- this is due to OpenLDAP involvement:

-> FortiAuthenticator has to check the user credentials against OpenLDAP

-> CHAP/MS-CHAPv2 send a password hash, not cleartext password

-> FortiAuthenticator could forward that password hash, but LDAP servers are not able to understand that, they expect cleartext password

- if you use a Windows (AD) LDAP server, and FortiAuthenticator is joined to the domain, you can also do MS-CHAPv2, as FortiAuthenticator can use NTLM to authenticate the user, and MS-CHAPv2 works in that context, but CHAP will not work then, either

So, what you probably need to do:

- do not use MS-CHAP-v2 for your wifi users

- check the RADIUS policies on FortiAuthenticator to ensure Wifi users are hitting the correct policy, not the one for SSLVPN users (assuming you DO have a separate policy for sslvpn and wifi)

I hope this helps!

Cheers,

Debbie

Hi Debbie and all the others. 

Thanks for your feedback. 
I wiil analyze your recomendations, and replicate them on my environment. 
Onve I have some outcome, I will let you know. 

Thanks a lot for your support!