Technical Tip: Configuring RADIUS through a VIP that is behind the VLAN

[dbhavsar]

Description	This article describes how to use RADIUS authentication from external resources that are behind the FortiGate VLAN.
Scope	FortiGate v6 and above.
Solution	Below is an example showing an external AP requesting RADIUS authentication from behind the FortiGate. Here, it is not necessary to configure the RADIUS server on the FortiGate itself. However, it is necessary to create the virtual IP on the FortiGate that forwards the RADIUS requests to the server. Set up the following configuration to create a virtual IP on the FortiGate: Below is the policy that must be created on FortiGate that will allow the RADIUS traffic: Furthermore, configure the RADIUS client on the RADIUS server. The client IP will be the VLAN IP address. Navigate to Server Manager -> Tools -> Network Policy Server -> Radius Client, then right-click and create a radius client. Here, 192.168.100.254 is the VLAN's interface IP address. NOTE: Using 'ALL' as a source in the policy is not best practice. If a known external IP is available, use it instead.