Description
This article explains how to understand the 'connect-info' attribute that FortiGate includes in RADIUS Access-Request messages it sends to RADIUS servers.
Scope
FortiGate, FortiProxy.
Solution
FortiGate (and FortiProxy) can use the RADIUS protocol to authenticate users or administrators under various circumstances. When sending an authentication request to a RADIUS server (Access-Request message), FortiGate includes an attribute 'connect-info' in the request that provides information on the source of the authentication request.
The 'connect-info' attribute is a default RADIUS attribute, but has no defined value and is used differently by different vendors.
The 'connect-info' attribute can have these values when sent by FortiGate/FortiProxy:
| test | FortiGate sends the RADIUS Access-Request as part of a test, either in GUI (Test Connectivity/Credentials) or in CLI (diagnose test authserver radius [...]) |
| vpn-ssl | FortiGate tries to authenticate an SSL-VPN user |
| vpn-ipsec | FortiGate tries to authenticate a user connecting to an IPSec IKEv1 tunnel |
| vpn-ikev2 | FortiGate tries to authenticate a user connecting to an IPSec IKEv2 tunnel |
| admin-login | FortiGate tries to authenticate an administrator |
| web-auth | FortiGate tries to authenticate a user on a portal it hosts (captive portal, proxy authentication, forward policy authentication) |
| CONNECT <bandwidth> <protocol> | Wi-Fi/Ethernet/802.1x-related authentication |
An example of attributes in a test login produced with FortiGate CLI command 'diagnose test authserver radius [...]', captured on FortiAuthenticator CLI with tcpdump:
Related articles:
Technical Tip: Restricting RADIUS connections based on the 'Connect Info' attribute on FortiGate and...
Technical Tip: How to match the right radius policy when multiple policy is configured for the same ...
Troubleshooting Tip: RADIUS authentication failure after the firmware upgrade to v7.2.10/v7.4.5/v7.6...
Technical Tip: RADIUS authentication with MAC binding
Technical Tip: RADIUS attributes sent to the server by the FortiGate as a RADIUS client
