FAC and FGT MAC Address bypass

[Luiz_Alberto_Camilo]

Hello there, 

I have a Fortigate with Radius authentication pointing to FAC and a internal workstation.
When the workstation tries to browse to any website, it hits a firewall rule that triggers an authentication and pops up an authentication page. If I type an username and password, it works just fine proving that the integration between FAC and FGT is well setup.

I want to use the FAC MAC Auth Bypass list where I create a MAC address and a string text. Inside Radius client configuration, I check the "Allow MAC-based Authentication" and not checking the "Require Call-check" box.

Again When from my workstation I try to browse to somesite, it pops up the Authentication login when I expect to bypass it. As far as I investigated, the action to browse to somesite just triggers the local authentication on Fortigate and the Fortigate doesn't forward Radius auth request to FAC at this point.

How Can I use FAC as Radius Server and use the MAC address bypass to centrally manage bypass devices on several Fortigates ? I cannot control it from each fortigate... Any tips ?

Thank you ! 

Luiz Alberto Camilo
Solutions Architect

[JameAlle]

Luiz,

This may be a topic that can better be addressed in our technical support forum. MAC address bypass is used as a way of allowing devices unable to authenticate via 802.1x. Did you configure the port for .1x authentication? A typical config could look something like this:

config system interface

edit "lan"

set ip 10.0.0.200 255.255.255.0

set security-mode 802.1X

set security-mac-auth-bypass enable

set security-groups "Radius-group"

end

If you did configure the port for .1x and you are still seeing the problem then reach out to technical support for assistance.

Hope this helps.

[Luiz_Alberto_Camilo]

I see, Thank you James.

As I'm using a Fortigate, there's no config like this. 
The one you mentioned is used on switches.. 

This behaviour looks like more as a Design then funcionality ..
I'll gather deep on Fortigate configuration options, and also direct a message to Support forum. 

Thank you very much ! 

Luiz Alberto Camilo
Solutions Architect