Description
This article describes how to fix repetitive authentication failures that are seen on FortiNAC GUI.
Scope
FortiNAC 9.2.x and 9.4.x.
Solution
Under Logs -> Events & Alarms, repetitive authentication failures can be seen on FortiNAC GUI.
Users are authenticated via RADIUS doing MAC authentication or EAP-TLS (machine) and are getting network access without any issue.
| Date |
Event |
Element |
Message |
| 11:40 |
Authentication Failure |
D4:54:8B:AA:88:33 |
User host/pc-01 failed to log on IP address 192.168.50.11 |
| 11:40 |
Authentication Failure |
Alex_IPad |
User B4-F6-1C-13-15-17 failed to log on IP address 192.168.60.11 |
This error can be checked by enabling the following debug:
> nacdebug -name DirectoryAuthentication true
yams.DirectoryAuthentication FINER :: 2022-12-19 10:51:19:773 :: #81 :: DirectoryAuthentication::getUserByUserID failed to find null trying other formats
yams.DirectoryAuthentication FINER :: 2022-12-19 10:51:19:774 :: #81 :: DirectoryAuthentication::loginHost getUserByUserID returning null
yams.DirectoryAuthentication FINER :: 2022-12-19 10:51:19:774 :: #81 :: DirectoryAuthentication::loginHost origClient IS null throw log on failure
This logs are not related to RADIUS authentication.
This is a specific feature that is used to log in users based on user information obtainable from a network device through an L2 poll. In this case, this attempt to log in does not filter out mac addresses or host/* names (typical Windows AD machine auth. user id).
It can be verified if facing this issue by disabling the L2 poll user login feature for devices that are contributing to the event logs regarding the authentication problem user info. It can be done by setting the attribute 'LoginUserFromForwardingData' to false on the device model.
device -ip <IP of Network Device> -setAttr -name LoginUserFromForwardingData -value false
Example:
device -ip 10.0.0.1 -setAttr -name LoginUserFromForwardingData -value false
By disabling this option, it will affect FortiNAC policies (if there are any configured) that rely on having a logged-on user, and that user is no longer being logged on through another means (RADIUS, agent, etc.).
A new line is added for that device:
> device -ip 10.0.0.1
...
Name = LoginUserFormForwardingData value = false length = 5
