|
There are several instances where a system administrator may integrate FortiGate authentication through Network Policy Server (NPS) infrastructure with Microsoft Entra multifactor authentication. For instance, endpoints can connect to SSL VPN via RADIUS NPS, then after several years or months, end-users are unable to connect to SSL VPN even though they did not make any changes.
Troubleshooting steps:
- Confirm that the authentication request reaches the FortiGate by running the following commands in the FortiGate. CLI:
diagnose debug disable
diagnose debug reset
diagnose debug console timestamp enable
diagnose debug application fnbamd -1
diagnose debug application authd -1
diagnose debug enable
diagnose test authserver radius <serverName> <scheme> <username> <password>
To stop debugging:
diagnose debug disable
It should be possible to see that RADIUS Access-Request traffic reached the FortiGate, but the RADIUS server is not sending a reply. Confirm this by analyzing the packet reaching the RADIUS server, such as by using Wireshark. For example: diagnose sniffer packet <interface_name> <'filter'> <verbose> <count> <tsformat>.
diagnose sniffer packet port1 port 1812
Refer to this document: Packet capture.
- Verify that the NPS extension for Azure MFA was installed on the RADIUS server. To do so, open a Windows command prompt and enter the following:
appwiz.cpl
- Confirm the certificate validity through the certificate store if necessary.
- After confirming certificate validity, it should be possible to resolve the issue by renewing the self-signed certificate through the use of a PowerShell script located at C:\Program Files\Microsoft\AzureMfa\Config (where C:\ is the installation drive).
The script will create a self-signed certificate, associate the public key with the service principal on Microsoft Entra ID, store the certificate in the local machine certificate store, grant access to the certificate's private key to the Network User, and finally, restart the NPS service. See Integrate your existing Network Policy Server (NPS) infrastructure with Microsoft Entra multifactor ... for more information.
Additional steps for systems that use the Microsoft Azure Government:
- Connect to the NPS servers and launch a Windows command prompt, then enter the following:
regedit.msc
- Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AzureMfa.
|
Registry key
|
Value
|
|
AZURE_MFA_HOSTNAME
|
strongauthenticationservice.auth.microsoft.us
|
|
AZURE_MFA_RESOURCE_HOSTNAME
|
adnotifications.windowsazure.us
|
|
STS_URL
|
https://login.microsoftonline.us/
|
- Restart the NPS service on Microsoft Windows Server via services.msc.
|
