Technical Tip: The AP of portal policy does not co...

FortiAuthenticator

FortiAuthenticator provides centralized authentication services for the Fortinet Security Fabric including multi-factor authentication, single sign-on services, certificate management, and guest management.

Article Id 383255

Description

This article describes the possible reasons that can cause the error where the AP of portal policy does not contain the client.

Scope

FortiAuthenticator.

Solution

Radius debug:

2025-02-25T17:56:15.101000+05:30 FortiAuthenticator radiusd[2909]: (29) facauth: facauth: recv Access-Request from 127.0.0.1 port 48951, id=2, length=138
2025-02-25T17:56:15.101011+05:30 FortiAuthenticator radiusd[2909]: User-Name = "918668135962"
2025-02-25T17:56:15.101266+05:30 FortiAuthenticator radiusd[2909]: NAS-IP-Address = 127.0.0.1
2025-02-25T17:56:15.101287+05:30 FortiAuthenticator radiusd[2909]: NAS-Port = 20
2025-02-25T17:56:15.101298+05:30 FortiAuthenticator radiusd[2909]: NAS-Identifier = "FAC_GUEST:13:fac.joshi.in"
2025-02-25T17:56:15.101305+05:30 FortiAuthenticator radiusd[2909]: User-Password: ******
2025-02-25T17:56:15.101313+05:30 FortiAuthenticator radiusd[2909]: Calling-Station-Id = "e1:cf:86:ac:01:40"
2025-02-25T17:56:15.101322+05:30 FortiAuthenticator radiusd[2909]: Framed-IP-Address = 40.41.240.30
2025-02-25T17:56:15.101332+05:30 FortiAuthenticator radiusd[2909]: Message-Authenticator = 0xf8ec2c6481e7b1be2824c8e33b41acda
2025-02-25T17:56:15.101343+05:30 FortiAuthenticator radiusd[2909]: Event-Timestamp = "Feb 25 2025 17:56:15 IST"
2025-02-25T17:56:15.101352+05:30 FortiAuthenticator radiusd[2909]: (29) facauth: ===>NAS IP:127.0.0.1
2025-02-25T17:56:15.101362+05:30 FortiAuthenticator radiusd[2909]: (29) facauth: ===>Username:918668135962
2025-02-25T17:56:15.101376+05:30 FortiAuthenticator radiusd[2909]: (29) facauth: ===>Timestamp:1740486375.99971, age:1ms
2025-02-25T17:56:15.102195+05:30 FortiAuthenticator radiusd[2909]: (29) facauth: ERROR: The AP of portal policy 13 does not contain client fac.joshi.in

Possible use cases for this error to trigger:

An auth request comes from an unknown AP.
NAS Identifier received the client as 'fac.joshi.in' however Access point was configured for IP instead of FQDN.
If the auth portal address is configured additionally on FortiGate and deployed with IP in the Access point of FortiAuthenticator.

config firewall auth-portal
set portal-addr 'fac.joshi.in'
end

195

Contributors

Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.

Technical Tip: The AP of portal policy does not contain client error

You are leaving our website