NOTE: FortiNAC is now named FortiNAC-F. For post-9.4 articles, see FortiNAC-F. FortiNAC is a zero-trust network access solution that provides users with enhanced visibility into the Internet of Things (IoT) devices on their enterprise networks.
This article describes how to use Wireshark to make sure the radius secret entered in all places in FortiNAC is correct.
Scope
FortiNAC version 9.1 and above.
Solution
In the FortiNAC CLI:
For CentOS-based FortiNAC versions:
Run the following commands:
logs
tcpdump -nni any host <switch-ip/WLC> and (port 3799 or 1812 or 1645) -w CoA_Capture.pcap
Generate radius traffic by attempting a connection.
Export CoA_Capture.pcap with the same method as this article uses to extract grab-logs.
For NACOS v7.x:
Follow the instructions in this article to get the PCAP file. Open the .pcap file in Wireshark. Go to Edit -> preferences -> protocols -> radius -> enter the radius secret in use.
Expand the Radius protocol in the packet check for the Authenticator attribute.
If there is no [incorrect] in front of the attribute, the radius secrets are correct in FortiNAC, the model config tab, and when 'right-clicking' model config.
