Troubleshooting Tip: Repetitive RADIUS log error

FortiNAC-F

FortiNAC-F is a zero-trust network access solution that provides users with enhanced visibility into the Internet of Things (IoT) devices on their enterprise networks. For legacy FortiNAC articles prior to FortiNAC-F 7.2, see FortiNAC.

Article Id 365164

Description

This article describes a new behavior observed in the RADIUS logs.

Scope

FortiNAC v9.4.7 and FortiNAC-OS v7.2.8, v7.4.0, v7.6.0.

Solution

There is a new RADIUS health check mechanism introduced in these firmware versions that causes a repeating log to be generated (approx. every 30 seconds). These logs can be identified by the red color and the mention of [nonExistUser]. An example line:

Tue Dec 17 09:54:03 2024 : Auth: (2537) Login incorrect (No Auth-Type found: rejecting the user via Post-Auth-Type = Reject): [nonExistUser] (from client localhost port 0)

From FortiNAC GUI it is shown like this:

Currently, these error logs can be safely ignored. On the next firmware release, this output will be hidden from the logs to avoid confusion while reading the RADIUS logs.

Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.