Technical Tip: How to configure FortiNAC to send the 'Message-Authenticator' attribute in Access-Accept message through Radius Authentication

[scitlak]

Description	This article describes how to fix the 'Authentication Failure' issue due to the missing 'Message-Authenticator' attribute that is mandatory with FortiOS 7.2.10 or 7.4.5.
Scope	FortiNAC, FortiNAC-F.
Solution	In case of a Radius Authentication with EAP, FortiNAC will send 'Access-Accept', 'Access-Reject', or 'Access-Challenge' messages with the 'Message-Authenticator' attribute. However, when MAB is in use, the 'Message-Authenticator' attribute will not be sent by FortiNAC by default and authentication will fail with FortiOS 7.2.10 or 7.4.5.  If 'fnbamd' debug log is enabled in FortiGate, the below debug logs can be observed. [1156] __rad_chk_resp_authenticator-No Message Authenticator [1210] fnbamd_rad_validate_pkt-Invalid digest By following the below steps, the 'Message-Authenticator' can be enabled for MAB. Under Network -> RADIUS ->Attributes Groups -> Select the Attribute Group that is already in use under Devices Model Configuration and select 'Modify'. In the left Window, filter the Attributes find the 'Message-Authenticator' attributes, and move it to the right window.                                                                                                        Select the 'Response Values' field and keep it empty shown as below. Then Select OK.                                                                                                                  Check the Radius Authentication and enable packet capture. The FortiNAC will send the 'Message-Authenticator' attribute with the Access-Accept message.                                                                                                                             Check the Authentication Status on FortiGate CLI and confirm it is Authorized. Note: Since the FortiGate test Radius request with username test01 will not match any 'Network Access Policy' and 'Logical Network' and FortiGate does not use EAP for test 'Radius-Request', FortiNAC will send an 'Access-Accept' without any additional Radius Attributes. As a consequence, FortiGate will still state an 'Invalid secret for the server'. 2nd option: Upgrade FortiNAC to v7.2.8, v7.4.1, v7.6.0 GA.