|
For configuration steps for RADIUS Authentication on FortiSwitch, see Troubleshooting Tip: Configure and troubleshoot 802.1x authentication on a Managed FortiSwitch.
FortiSwitch Configuration:
The following is the configuration required on FortiSwitch for 802.1X authentication using RADIUS servers.
- Configuring RADIUS Servers.
FortiSwitch# sh user radius
config user radius
edit "FortiGuest-1_156"
set nas-ip 10.37.165.67
set secret <radius-secret>
set server "10.36.196.156"
next
edit "FortiGuest-1_164"
set nas-ip 10.37.165.67
set secret <radius-secret>
set server "10.36.196.164"
next
end
- Creating a User Group.
FortiSwitch# sh user group
config user group
edit "Fguest"
set member "FortiGuest-1_156" "FortiGuest-1_164"
next
end
- Configuring Port Security on Port7.
FortiSwitch# sh switch interface port7
config switch interface
edit "port7"
set native-vlan 20
set allowed-vlans 4093
set untagged-vlans 4093
set security-groups "Fguest"
config port-security
set allow-mac-move-from disable
set auth-fail-vlan disable
set authserver-timeout-period 3
set authserver-timeout-vlan disable
set dacl disable
set eap-auto-untagged-vlans enable
set eap-egress-tagged enable
set eap-passthru enable
set framevid-apply enable
set guest-auth-delay 30
set guest-vlan disable
set mab-eapol-request 3
set mac-auth-bypass disable
set open-auth disable
set port-security-mode 802.1X
set quarantine-vlan enable
set radius-timeout-overwrite disable
set auth-fail-vlanid 200
set authserver-timeout-vlanid 300
set guest-vlanid 100
end
next
end
RADIUS Request Flow:
When an 802.1X client connects to port7, FortiSwitch follows this authentication process:
- FortiSwitch Sends RADIUS Request to Servers
- The FortiSwitch first sends a RADIUS request to 10.36.196.156.
- If there is no response, it sends the request to 10.36.196.164.
- RADIUS Response Handling
- Both servers will respond with a RADIUS Challenge.
- The FortiSwitch will prioritize the RADIUS server that responds first with a RADIUS Challenge, making it the default server for all subsequent RADIUS transactions.
- Failover Scenarios
- If 10.36.196.156 is unreachable, FortiSwitch will authenticate via 10.36.196.164.
- Important: If 10.36.196.156 sends a RADIUS Reject, FortiSwitch will not fail over to 10.36.196.164.
Conclusion:
This setup ensures that FortiSwitch properly handles 802.1X authentication requests using multiple RADIUS servers, with a primary-preferred and failover mechanism. However, failover does not occur if the primary server explicitly rejects authentication.
|
