Description
This article describes that in FortiOS v5, one may observe ‘authentication failure’ pop-up when an admin user attempt to authenticate thanks to a Radius server.
The following debug commands do NOT indicate why authentication fails.
diag debug app fnbamd -1
diag debug app radius -1
Scope
Solution
Verify which FGT interface receives the admin login request.
If the Login packet lands on a ‘root’ interface, the Radius server send back the required Fortinet 12356 vsa’s, and must add the string (‘root’) into the vsa Fortinet-Vdom-Name 3
ATTRIBUTE Fortinet-Group-Name 1 string (‘group-name’)
ATTRIBUTE Fortinet-Access-Profile 6 string (‘profile-name’)
ATTRIBUTE Fortinet-Vdom-Name 3 string (‘vdom-name’+ ‘root’)
If the packet lands on a ‘vdom-name’ interface, Radius server send back only the following vsa’s:
ATTRIBUTE Fortinet-Group-Name 1 string (‘group-name’)
ATTRIBUTE Fortinet-Access-Profile 6 string (‘profile-name’)
ATTRIBUTE Fortinet-Vdom-Name 3 string (‘vdom-name’)
Related Articles
Technical Tip: Remote admin login with Radius selecting admin access account profile
