|
There are several instances where a system administrator may integrate FortiGate authentication through Network Policy Server (NPS) infrastructure with Microsoft Entra multifactor authentication. For instance, endpoints are able to connect to SSL VPN via RADIUS NPS then after several years or months, end-users are unable to connect to SSL VPN even though they did not make any changes.
Troubleshooting steps:
- Confirm that the authentication request reaches the FortiGate by running the following commands in the FortiGate. CLI:
diag debug console timestamp enable
diag debug res
diag debug application fnbamd -1
diag debug application authd -1
diag debug enable
diag test authserver radius <serverName> <scheme> <username> <password>
diag debug disable
It should be possible to see that RADIUS Access-Request traffic reached the FortiGate, but the RADIUS is not sending a reply. Confirm this by analyzing the packet reaching the RADIUS server, such as by using Wireshark.
For example: diagnose sniffer packet <interface_name> <'filter'> <verbose> <count> <tsformat>.
diagnose sniffer packet port1 port 1812
Refer to this document: Packet capture.
- Verify that the NPS extension for Azure MFA was installed on the RADIUS server. To do so, open a Windows command prompt and enter the following:
appwiz.cpl
- Confirm the certificate validity through the certificate store if necessary.
- After confirming certificate validity, it should be possible to resolve the issue by renewing the self-signed certificate through the use of a PowerShell script located at C:\Program Files\Microsoft\AzureMfa\Config (where C:\ is the installation drive).
The script will create a self-signed certificate, associate the public key with the service principal on Microsoft Entra ID, store the certificate in the local machine certificate store, grant access to the certificate's private key to the Network User, and finally, restart the NPS service. See this article for more information.
Additional steps for systems that use the Microsoft Azure Government:
- Connect to the NPS servers and launch a Windows command prompt, then enter the following:
regedit.msc
- Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AzureMfa.
|
Registry key
|
Value
|
|
AZURE_MFA_HOSTNAME
|
strongauthenticationservice.auth.microsoft.us
|
|
AZURE_MFA_RESOURCE_HOSTNAME
|
adnotifications.windowsazure.us
|
|
STS_URL
|
https://login.microsoftonline.us/
|
- Restart the NPS service on Microsoft Windows Server via services.msc.
|
