FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
This article describes that the custom NAS-ID configured for the RADIUS will return the HA group name instead of the custom attribute.
Scope
FortiOS 7.2.4 + versions.
Solution
Custom NAS-ID configuration:
config user radius edit RADIUS set nas-id-type custom set nas-id Fortigate-RADIUS next
end
As per the configuration, the NAS-ID attribute should be sent as 'Fortigate-RADIUS', however when testing from the GUI, the NAS-ID will be sent as the group name 'FGT cluster' configured in the HA settings.
config system ha set group-id 1 set group-name "FGT cluster" set mode a-p end
It is reported as a GUI bug (# 1055336). As a workaround, perform the test in the CLI with the given command:
diag test authserver radius <server_name> <chap | pap | mschap | mschap2> <username> <password>
This bug will not impact the regular authentication and the issue is resolved in FortiOS 7.4.5 and 7.6.1 firmware versions.
