Technical Tip: Radius Accounting for SSL VPN Users

[bpozdena_FTNT]

Description

This article describes the steps to configure FortiGate to send RADIUS Accounting messages containing usernames and IP address of SSL VPN users.

Useful links:
CLI Reference.

Scope

FortiGate v5.6.11+,
FortiGate v6.0.7+,
FortiGate v6.2.1+.

Solution

Consider the following important requirements before implementing this solution:

• FortiGate should be running FortiOS versions 5.6.11+, v6.0.7+ or v6.2.1+. In earlier versions, FortiOS will report the client’s public IP address instead of the assigned tunnel IP address in the 'Framed-IP-Address' attribute value.
• The attribute 'Framed-IP-Address' will not be included in the RADIUS Accounting-Request Start message. It will be included only in Interim-Updates and Accounting Stop message.
• The Interim Accounting-Request will not be sent unless the radius server sends AVP: 'Acct-Interim-Interval' in the 'Access-Accept' message.
    Also, the Interim-Updates feature must be enabled on FortiGate under RADIUS profile.
• The minimum update interval for interim accounting messages can be set to 600 seconds.
  
  There are two steps to complete this configuration:
  

1. Configure SSL VPN access for RADIUS users.
   See this example.
   
   
2. Configure FortiGate to send RADIUS Accounting:
   

config user radius   
    edit <RADIUS_PROFILE_NAME>   
        set server <Radius_Server_IP>             <----- Specify the IP address of the RADIUS authentication server.
        set secret <password>                     <----- Secret used to authenticate with the RADIUS authentication server.
        set acct-interim-interval 600             <----- Enable sending of Interim Accounting updates every 10 minutes.
        config accounting-server   
            edit 1   
                set status enable                 <----- Enable sending of RADIUS Accounting messages.
                set server <Radius_Server_IP>     <----- Specify the IP address of the RADIUS accounting server.
                set secret <password>             <----- Secret used to authenticate with the RADIUS accounting server.
            next   
        end   
    next   
end   

3. Ensure the RADIUS server is configured to send AVP 'Acct-Interim-Interval:600' in the Access-Accept message.

Example:

 

Verification of Configuration:

The following packet captures show the effect of the above configuration in action.