| Description | This article shows how to configure and validate RADIUS accounting configuration in order to update the Switchport state when a host disconnects. |
| Scope | FortiNAC-F. |
| Solution |
The RADIUS protocol is one of the methods that FortiNAC uses for learning endpoints connecting to the Network. When a host connects, FortiNAC will parse the attributes from the incoming RADIUS Access-Request in order to update the Port state as 'Link up' and show the connecting host with the respective Icon depending on its state.
When a host disconnects, FortiNAC can leverage the RADIUS Accounting stop messages as an endpoint connectivity notification method and change the port state to "Link down".
Admin status is on and Link status is down, indicating that nothing is connected. This dynamic way of learning the port state change is very important in order for FortiNAC to establish visibility and apply appropriate controls on the port.
An example could be the case where the administrator wants to reset the VLAN on the port to the 'Default' or 'Registration' Vlan when there is no host connected.
The 'Default' VLAN will be applied on the port when the port is made a member of the 'Reset Forced Default' in FortiNAC port group membership and there is no host connected.
However, that does not happen immediately. A timer of 60 seconds(default) will be reached before the VLAN is reset.
'VLAN Reset Delay (Sec)' is defined in System->Settings->Network Device
Without RADIUS accounting, FortiNAC will rely on L2 polling SNMP traps or any other method/protocol supported by the Switch in order to dynamically update the port state.
In the below example, a Host disconnects from a FortiSwitch in FortiLink Mode. By enabling tcpdump in FortiNAC it is possible to verify that FortiNAC is responding to the Accounting Stop message when a host disconnects from the Switch by unplugging the ethernet cable.
naclab1# execute tcpdump -i any port 1813 -v 10.10.250.50.35490 > naclab1.forti.lab.radius-acct: RADIUS, length: 162 naclab1.forti.lab.radius-acct > 10.10.250.50.35490: RADIUS, length: 20
In FortiNAC output.master the following events will be logged:
yams.RadiusAccess.C8:A3:62:04:D7:20 FINE :: 2024-11-06 17:00:49:374 :: #828 :: GetClient: Client found for MAC [C8:A3:62:04:D7:20]
Once FortiNAC responds to the Accounting STOP request, it will update the Port view in GUI by showing the port state as 'Link Down'.
When configuring RADIUS accounting in FortiNAC, check the following.
naclab1 # show system interface
naclab1:~$ netstat -panu | grep 1813
This can also be verified on the GUI in Network -> RADIUS -> Service logs:
 Figure 1. Validate if FortiNAC is listening for Requests on UDP Port 1813
In some versions, FortiNAC might not start listening on port 1813 when using the Local Radius configuration. In such cases, it is required to enable the Radius Proxy service or 'Proxy Accounting' service and create a RADIUS proxy server configuration.
This is required only for Local Radius to start listening on port 1813. This issue is reported in engineering report 1069166 and will be fixed in FortiNAC versions 7.4.1 GA and greater.
Related Documentation: Troubleshooting Tip: Viewing FortiNAC-F local RADIUS logs from GUI |
