7.2.10 Breaks DUO Radius proxy

[gattac]

We have a few customers who use the DUO Radius proxy to provide 2fa for the VPN. After an automatic update to 7.2.10 the user receives the DUO prompt, but authentication never completes. There is a known bug int the release notes about radius not working in the UI, and the workaround is to use the CLI to test authentication, but not that it would break any actual functionality.

For now we have rolled back to 7.2.9 but just wanted to give a heads up.

[saleha]

Hi gattac,

Thank you for reaching out. I assume this is relevant to changes done on 7.2.10 to mitigate against a radius vulnerability as described on release notes here:
https://docs.fortinet.com/document/fortigate/7.2.10/fortios-release-notes/5880/radius-vulnerability

You can try RADSEC which is tls authentication. An example to such deployment is on the following link:

https://docs.fortinet.com/document/fortigate/7.4.5/administration-guide/729374/configuring-a-radsec-...

Thank you,

saleha

[Toshi_Esumi]

@saleha 
Even feroz_ftnt's comment in this reddit thread is not clear. 
https://www.reddit.com/r/fortinet/comments/1fnrpf8/fortigate_200f_radius_response_fails_after/

Is this a problem triggered by FortiOS 7.2.10 started attaching Message-Authenticator(80) attribute and Duo doesn't reply with the correct attribute value after re-calculation, or just doesn't reply?
Or is this FortiOS 7.2.10's bug miscalculating the replied value from Duo?

The FGT GUI issue described in the thread has to be a separate issue only for the testing method because that doesn't involves actual user authentication incomplete.

Toshi

[amuda]

Hi @gattac 

Please refer to this KB: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-RADIUS-authentication-failure-after-...

[Toshi_Esumi]

@amudaSo are you saying Duo is not set up properly to replying to FGT's Auth Request with Message-Authenticator attribute (80) , or in other words the Duo server side is ignoring the attribute? I'm asking this because the KB is stating below:
"To fix this, enable the message-authenticator attribute on the third-party RADIUS server to include on its RADIUS messages."

And, @gattac Can you confirm this is indeed the fact? To confirm, you have to go back to 7.2.10 again after changing the setting, whatever it is, on the Duo side though. 

Toshi

[pminarik]

Given that Duo are currently handwaving the issue away (for perfectly valid reasons IMO), I think it's safe to assume they don't utilize Message-Authenticator at all and thus the new FortiOS versions will reject their replies. Otherwise I see no reason why they wouldn't just happily confirm that they're already capable of dealing with this attack vector.

[jokes54321]

Fortinet sure put us in a very bad position on this one. Upgrade the firmware on 70+ firewalls to 7.2.10, and FortiAuthenticator 6.6.2, all in the same evening, so we don't cause random outages across the company. 

They should have implemented backward compatibility into Authenticator 6.6.2, to allow us time to upgrade the firewalls before enforcing this. 

[Toshi_Esumi]

I tend to agree to @jokes54321 's idea although I don't blame FTNT to implement this Message-Authenticator attribute now while this is an industry standard by now and all others have done this already, except Duo and a few other RADIUS server providers.

FortiOS could have provide an exception flag, "legacy RADIUS server", in the RADIUS configuration so that the server can be excluded from the "mandatory" Message-Authenticator attribute check, which freeRADIUS exactly did with their newer release as I described in my post:
https://community.fortinet.com/t5/Support-Forum/RADIUS-attribute-Message-Authenticator/td-p/327120
so that they can accept like old FortiOS as a client when it didn't send the attribute.

The developers(volunteers) put a little more thoughts on this when they introduced the version including this mandatory attribute. Smarter.

Toshi

[Toshi_Esumi]

So my conclusion for this issue based on last a couple of days of research over this community posts and Reddit posts, only solution with 7.2.10/7.4.5 or newer versions that would come out in the future is to set Duo Auth proxy to bypass Message-Authenticator attribute or all attributes to/from a backend auth server like Windows NPS/AD since Duo proxy itself doesn't support the attribute or TLS/RadSec at this moment.
https://help.duo.com/s/article/9014?language=en_US
https://help.duo.com/s/article/8930?language=en_US

Toshi

[saleha]

Hi Toshi_Esumi,

I hope the following clears up the information:
- FortiOS 7.2.10, 7.4.5 and future release 7.6.1 also require message-authentication attribute in radius setup with udp or tcp

- RADSEC or TLS is a way around this however it is currently not supported on DUO

- I have looked up DUO page and can only find them referencing pass-through options that includes message-authentication as provided at the following pages:
https://help.duo.com/s/article/7537?language=en_US
https://help.duo.com/s/article/9014?language=en_US

- I am not sure if the above articles apply to all kind of setup or just DUO proxy setup

- DUO according to the following announcement are actively investigating into allowing RADSEC authentication yes:

https://help.duo.com/s/article/8932?language=en_US

Thank you,

saleha